Pin dependencies

.github/workflows/change-app-version.yml

@@ -66,18 +66,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Configure OP-Connect"
-        uses: 1password/load-secrets-action/configure@v5
+        uses: 1password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         with:
           connect-host: https://op-connect.jk-dev.de
       - name: "Load GitHub Credentials"
         id: load-jk-cluster-bot-creds
-        uses: 1password/load-secrets-action@v5
+        uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         env:
           OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
           JK_CLUSTER_BOT_TOKEN: op://GitHub-Actions/github-helm-charts-push-token/credential
           JK_CLUSTER_USERNAME: op://GitHub-Actions/github-helm-charts-push-token/username
           JK_CLUSTER_EMAIL: op://GitHub-Actions/github-helm-charts-push-token/email
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ env.JK_CLUSTER_BOT_TOKEN }}
       - name: "Get Chart Version"

.github/workflows/install-test-all-charts.yml

@@ -36,7 +36,7 @@ jobs:
       count: ${{ steps.select.outputs.count }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Select the charts to test"
         id: select
         env:

.github/workflows/install-test.yml

@@ -132,9 +132,9 @@ jobs:
       RUNNER_LABEL: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-docker' }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       - name: "Install kubectl"
         run: |
           # kubectl and the cluster are a pair: the client talks to the server
@@ -206,13 +206,13 @@ jobs:
       # touches the VPN key.
       - name: "Configure OP-Connect"
         if: matrix.chart == 'freesailarr'
-        uses: 1password/load-secrets-action/configure@v5
+        uses: 1password/load-secrets-action/configure@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         with:
           connect-host: https://op-connect.jk-dev.de
       - name: "Load freesailarr VPN credentials"
         id: load-freesailarr-vpn
         if: matrix.chart == 'freesailarr'
-        uses: 1password/load-secrets-action@v5
+        uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5
         env:
           OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
           FREESAILARR_WG_KEY: op://GitHub-Actions/freesailarr-mullvad-test-config/credential

.github/workflows/validate-charts.yml

@@ -15,7 +15,7 @@ jobs:
       any-install: ${{ steps.detect.outputs.any-install }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: "Detect changed charts"
@@ -116,11 +116,11 @@ jobs:
         chart: ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       # Both steps below refuse to run while a chart declares a dependency that
       # is not in its charts/ directory - lint with "[WARNING] chart directory
       # is missing these dependencies", package with "found in Chart.yaml, but
@@ -167,9 +167,9 @@ jobs:
     # build-chart, so it adds no wall-clock time to the pipeline.
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       - name: "Render every chart with bare integer quantities"
         run: ci/run-quantity-render-test.sh
 
@@ -197,9 +197,9 @@ jobs:
       TRIVY_CONFIG_MODE: report
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       # A plain release download rather than aquasecurity/setup-trivy, and the
       # reason is measured on the Gitea probe PR of #225, not assumed. That
       # action runs actions/checkout against aquasecurity/trivy on github.com