pulumi · blampe · Dec 23, 2024 · Dec 21, 2024
diff --git a/.devcontainer/aws/Dockerfile b/.devcontainer/aws/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/pulumi/devcontainer:extra
+FROM ghcr.io/pulumi/devcontainer:extra@sha256:e8534db8f45cfd886f74ce806ab71aaa7b5016a880570dc5d984dc56a0b106f4
 
 ##################################################################################
 # Install AWS CLI v2

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -88,22 +88,22 @@ runs:
   using: composite
   steps:
     - name: Install .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4
       with:
         dotnet-version: ${{inputs.dotnet-version}}
 
     - name: Install Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
       with:
         node-version: ${{inputs.node-version}}
 
     - name: Install Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
       with:
         python-version: ${{inputs.python-version}}
 
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5
       with:
         go-version: ${{inputs.go-version}}
         cache-dependency-path: "**/go.sum"
@@ -149,7 +149,7 @@ runs:
 
     - name: Authenticate with AWS
       id: aws-auth
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
       with:
         aws-access-key-id: ${{ inputs.aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
@@ -161,13 +161,13 @@ runs:
         output-credentials: true
 
     - name: Authenticate with Google Cloud
-      uses: google-github-actions/auth@v2
+      uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
       with:
         service_account: ${{ inputs.google-service-account-email }}
         workload_identity_provider: projects/${{ inputs.google-project-number }}/locations/global/workloadIdentityPools/${{ inputs.google-workload-identity-pool }}/providers/${{ inputs.google-workload-identity-provider }}
 
     - name: Install gcloud auth
-      uses: google-github-actions/setup-gcloud@v2
+      uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2
       with:
         install_components: gke-gcloud-auth-plugin
 

diff --git a/.github/workflows/add-to-project.yaml b/.github/workflows/add-to-project.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add to DevRel
-        uses: actions/[email protected]
+        uses: actions/add-to-project@960fbad431afda394cfcf8743445e741acd19e85 # v0.4.0
         with:
           project-url: https://github.com/orgs/pulumi/projects/47
           github-token: ${{ secrets.PULUMI_BOT_GHA_MARKETING }}
diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Run Build
-      uses: peter-evans/slash-command-dispatch@v2
+      uses: peter-evans/slash-command-dispatch@40877f718dce0101edfc7aea2b3800cc192f9ed5 # v2
       with:
         commands: run-tests
         issue-type: pull-request

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Comment PR
-      uses: thollander/actions-comment-pull-request@v1
+      uses: thollander/actions-comment-pull-request@8a3fad13c20088e9eb0805666b9fe49509d2fec8 # v1
       with:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         message: >

diff --git a/.github/workflows/test-examples.yml b/.github/workflows/test-examples.yml
@@ -18,7 +18,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup
@@ -40,7 +40,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup
@@ -64,7 +64,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup
@@ -88,7 +88,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup
@@ -110,7 +110,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup
@@ -142,7 +142,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup
@@ -202,7 +202,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up the environment
         uses: ./.github/actions/setup

diff --git a/alicloud-ts-ecs/package.json b/alicloud-ts-ecs/package.json
@@ -1,7 +1,7 @@
 {
     "name": "alicloud-ts-ecs",
     "devDependencies": {
-        "@types/node": "^14"
+        "@types/node": "14.18.63"
     },
     "dependencies": {
         "@pulumi/alicloud": "3.70.0",

diff --git a/aws-apigateway-ts-routes/package.json b/aws-apigateway-ts-routes/package.json
@@ -1,8 +1,8 @@
 {
     "name": "typescript",
     "devDependencies": {
-        "@types/aws-lambda": "^8.10.85",
-        "@types/node": "^8.0.0"
+        "@types/aws-lambda": "8.10.146",
+        "@types/node": "8.10.66"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-cs-fargate/App/Dockerfile b/aws-cs-fargate/App/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/core/sdk:3.1 AS build
+FROM mcr.microsoft.com/dotnet/core/sdk:3.1@sha256:150d074697d1cda38a0c2185fe43895d84b5745841e9d15c5adba29604a6e4cb AS build
 WORKDIR /app/src
 
 # First restore dependencies so app changes are faster.
@@ -10,7 +10,7 @@ COPY * ./
 RUN dotnet publish -c release -o /app/bin --no-restore
 
 # Create a new, smaller image stage, that just runs the DLL.
-FROM mcr.microsoft.com/dotnet/core/aspnet:3.1
+FROM mcr.microsoft.com/dotnet/core/aspnet:3.1@sha256:e3b773f30a0a6e88d71ce52429f6847627fc9353e491346902ca345760b82bdd
 WORKDIR /app
 COPY --from=build /app/bin ./
 ENTRYPOINT [ "dotnet", "aws-cs-fargate.dll" ]
diff --git a/aws-cs-langserve/Dockerfile b/aws-cs-langserve/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.11-slim@sha256:370c586a6ffc8c619e6d652f81c094b34b14b8f2fb9251f092de23f16e299b78
 
 RUN pip install poetry==1.6.1
 

diff --git a/aws-go-fargate/app/Dockerfile b/aws-go-fargate/app/Dockerfile
@@ -1,6 +1,6 @@
 # Start from a Debian image with the latest version of Go installed
 # and a workspace (GOPATH) configured at /go.
-FROM golang
+FROM golang@sha256:70031844b8c225351d0bb63e2c383f80db85d92ba894e3da7e13bcf80efa9a37
 
 # Copy the local package files to the container's workspace.
 ADD . /go/src/foo

diff --git a/aws-go-langserve/Dockerfile b/aws-go-langserve/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.11-slim@sha256:370c586a6ffc8c619e6d652f81c094b34b14b8f2fb9251f092de23f16e299b78
 
 RUN pip install poetry==1.6.1
 

diff --git a/aws-js-containers/app/Dockerfile b/aws-js-containers/app/Dockerfile
@@ -1,2 +1,2 @@
-FROM nginx
+FROM nginx@sha256:fb197595ebe76b9c0c14ab68159fd3c08bd067ec62300583543f0ebda353b5be
 COPY content /usr/share/nginx/html
diff --git a/aws-js-langserve/Dockerfile b/aws-js-langserve/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.11-slim@sha256:370c586a6ffc8c619e6d652f81c094b34b14b8f2fb9251f092de23f16e299b78
 
 RUN pip install poetry==1.6.1
 

diff --git a/aws-py-django-voting-app/frontend/Dockerfile b/aws-py-django-voting-app/frontend/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:18.04
+FROM ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98
 
 WORKDIR /
 

diff --git a/aws-py-langserve/Dockerfile b/aws-py-langserve/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.11-slim@sha256:370c586a6ffc8c619e6d652f81c094b34b14b8f2fb9251f092de23f16e299b78
 
 RUN pip install poetry==1.6.1
 

diff --git a/aws-py-voting-app/frontend/Dockerfile b/aws-py-voting-app/frontend/Dockerfile
@@ -1,3 +1,3 @@
-FROM tiangolo/uwsgi-nginx-flask:python3.6
+FROM tiangolo/uwsgi-nginx-flask:python3.6@sha256:07b3a61dc2f6d6b294065f929d33cdf6416133320cf61cc66b7cdb1428460e75
 RUN  pip install redis
 COPY /app /app
diff --git a/aws-ts-airflow/airflow-container/Dockerfile b/aws-ts-airflow/airflow-container/Dockerfile
@@ -1,3 +1,3 @@
-FROM puckel/docker-airflow
+FROM puckel/docker-airflow@sha256:e3012994e4e730dccf56878094ff5524bffbe347e5870832dd6f7636eb0292a4
 
 ADD dags /usr/local/airflow/dags
diff --git a/aws-ts-airflow/package.json b/aws-ts-airflow/package.json
@@ -1,7 +1,7 @@
 {
     "name": "airflow",
     "devDependencies": {
-        "@types/node": "^18.13.0"
+        "@types/node": "18.19.68"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-ansible-wordpress/package.json b/aws-ts-ansible-wordpress/package.json
@@ -1,7 +1,7 @@
 {
 		"name": "pulumi-ansible-wordpress",
 		"devDependencies": {
-				"@types/node": "^18"
+				"@types/node": "18.19.68"
 		},
 		"dependencies": {
 				"@pulumi/aws": "6.65.0",

diff --git a/aws-ts-apigateway-auth0/package.json b/aws-ts-apigateway-auth0/package.json
@@ -1,7 +1,7 @@
 {
     "name": "aws-typescript",
     "devDependencies": {
-        "@types/node": "^18.0.0"
+        "@types/node": "18.19.68"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-apigateway-eventbridge/package.json b/aws-ts-apigateway-eventbridge/package.json
@@ -1,7 +1,7 @@
 {
     "name": "aws-ts-apigateway-eventbridge",
     "devDependencies": {
-        "@types/node": "^14"
+        "@types/node": "14.18.63"
     },
     "dependencies": {
         "@pulumi/pulumi": "3.144.1",

diff --git a/aws-ts-apigateway-lambda-serverless/package.json b/aws-ts-apigateway-lambda-serverless/package.json
@@ -1,8 +1,8 @@
 {
     "name": "aws-ts-apigateway-lambda-serverless",
     "devDependencies": {
-        "@types/aws-lambda": "^8.10.72",
-        "@types/node": "^10.0.0"
+        "@types/aws-lambda": "8.10.146",
+        "@types/node": "10.17.60"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-apigatewayv2-eventbridge/package.json b/aws-ts-apigatewayv2-eventbridge/package.json
@@ -1,7 +1,7 @@
 {
     "name": "aws-ts-apigatewayv2-eventbridge",
     "devDependencies": {
-        "@types/node": "^14"
+        "@types/node": "14.18.63"
     },
     "dependencies": {
         "@pulumi/pulumi": "3.144.1",

diff --git a/aws-ts-apigatewayv2-http-api-quickcreate/package.json b/aws-ts-apigatewayv2-http-api-quickcreate/package.json
@@ -1,7 +1,7 @@
 {
     "name": "aws-ts-apigatewayv2-quickstart",
     "devDependencies": {
-        "@types/node": "^10.0.0"
+        "@types/node": "10.17.60"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-apigatewayv2-http-api/package.json b/aws-ts-apigatewayv2-http-api/package.json
@@ -1,7 +1,7 @@
 {
     "name": "aws-ts-apigatewayv2-http-api",
     "devDependencies": {
-        "@types/node": "^10.0.0"
+        "@types/node": "10.17.60"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-assume-role/assume-role/package.json b/aws-ts-assume-role/assume-role/package.json
@@ -1,7 +1,7 @@
 {
     "name": "assume-role",
     "devDependencies": {
-        "@types/node": "^8.0.0"
+        "@types/node": "8.10.66"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-assume-role/create-role/package.json b/aws-ts-assume-role/create-role/package.json
@@ -1,7 +1,7 @@
 {
     "name": "create-role",
     "devDependencies": {
-        "@types/node": "^8.0.0"
+        "@types/node": "8.10.66"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-containers-dockerbuild/app/Dockerfile b/aws-ts-containers-dockerbuild/app/Dockerfile
@@ -1,2 +1,2 @@
-FROM nginx
+FROM nginx@sha256:fb197595ebe76b9c0c14ab68159fd3c08bd067ec62300583543f0ebda353b5be
 COPY content /usr/share/nginx/html
diff --git a/aws-ts-containers-dockerbuild/package.json b/aws-ts-containers-dockerbuild/package.json
@@ -8,6 +8,6 @@
         "@pulumi/pulumi": "3.144.1"
     },
     "devDependencies": {
-        "@types/node": "^20.14.10"
+        "@types/node": "20.17.10"
     }
 }
diff --git a/aws-ts-containers-dockerbuildcloud/app/Dockerfile b/aws-ts-containers-dockerbuildcloud/app/Dockerfile
@@ -1,2 +1,2 @@
-FROM nginx
+FROM nginx@sha256:fb197595ebe76b9c0c14ab68159fd3c08bd067ec62300583543f0ebda353b5be
 COPY content /usr/share/nginx/html
diff --git a/aws-ts-containers-dockerbuildcloud/package.json b/aws-ts-containers-dockerbuildcloud/package.json
@@ -8,6 +8,6 @@
         "@pulumi/pulumi": "3.144.1"
     },
     "devDependencies": {
-        "@types/node": "^20.12.11"
+        "@types/node": "20.17.10"
     }
 }
diff --git a/aws-ts-containers/app/Dockerfile b/aws-ts-containers/app/Dockerfile
@@ -1,2 +1,2 @@
-FROM nginx
+FROM nginx@sha256:fb197595ebe76b9c0c14ab68159fd3c08bd067ec62300583543f0ebda353b5be
 COPY content /usr/share/nginx/html
diff --git a/aws-ts-containers/package.json b/aws-ts-containers/package.json
@@ -7,6 +7,6 @@
         "@pulumi/pulumi": "3.144.1"
     },
     "devDependencies": {
-        "typescript": "^4.6.2"
+        "typescript": "4.9.5"
     }
 }
diff --git a/aws-ts-ec2-provisioners/package.json b/aws-ts-ec2-provisioners/package.json
@@ -3,7 +3,7 @@
     "version": "0.1.0",
     "main": "index.js",
     "devDependencies": {
-        "@types/node": "^18"
+        "@types/node": "18.19.68"
     },
     "dependencies": {
         "@pulumi/aws": "6.65.0",

diff --git a/aws-ts-ecs-anywhere/app/Dockerfile b/aws-ts-ecs-anywhere/app/Dockerfile
@@ -1,9 +1,9 @@
-FROM node:15-alpine as build
+FROM node:15-alpine@sha256:6edd37368174c15d4cc59395ca2643be8e2a1c9846714bc92c5f5c5a92fb8929 as build
 WORKDIR /app
 COPY package*.json .
 RUN npm ci --only=production
 COPY index.js .
-FROM node:15-alpine
+FROM node:15-alpine@sha256:6edd37368174c15d4cc59395ca2643be8e2a1c9846714bc92c5f5c5a92fb8929
 WORKDIR /app
 COPY --from=build /app .
 EXPOSE 80

diff --git a/aws-ts-ecs-anywhere/package.json b/aws-ts-ecs-anywhere/package.json
@@ -1,7 +1,7 @@
 {
   "name": "ecs-anywhere",
   "devDependencies": {
-    "@types/node": "^18.0.0"
+    "@types/node": "18.19.68"
   },
   "dependencies": {
     "@pulumi/aws": "6.65.0",