Pin dependencies

.github/workflows/build-test-operator.yaml

@@ -30,7 +30,7 @@ jobs:
     if: needs.check-secrets.outputs.have-secrets == 'true'
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
     - name: Set latest tag for non main branch
       if: github.ref_name != 'main'
@@ -41,15 +41,15 @@ jobs:
 
     - name: Buildah Action
       id: build-test-operator
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
       with:
         image: test-operator
         tags: ${{ env.latesttag }} ${{ github.sha }}
         containerfiles: |
           ./Dockerfile
 
     - name: Push test-operator To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-test-operator.outputs.image }}
         tags: ${{ steps.build-test-operator.outputs.tags }}
@@ -65,28 +65,28 @@ jobs:
 
     steps:
     - name: Install Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
         go-version: 1.24.x
 
     - name: Checkout test-operator repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
     - name: Install operator-sdk
-      uses: redhat-actions/openshift-tools-installer@v1
+      uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1
       with:
         source: github
         operator-sdk: '1.41.1'
 
     - name: Log in to Quay Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: ${{ env.imageregistry }}
         username: ${{ secrets.QUAY_USERNAME }}
         password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Log in to Red Hat Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: registry.redhat.io
         username: ${{ secrets.REDHATIO_USERNAME }}
@@ -113,15 +113,15 @@ jobs:
 
     - name: Build test-operator-bundle using buildah
       id: build-test-operator-bundle
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
       with:
         image: test-operator-bundle
         tags: ${{ env.latesttag }} ${{ github.sha }}
         containerfiles: |
           ./bundle.Dockerfile
 
     - name: Push test-operator To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: ${{ steps.build-test-operator-bundle.outputs.image }}
         tags: ${{ steps.build-test-operator-bundle.outputs.tags }}
@@ -137,7 +137,7 @@ jobs:
 
     steps:
     - name: Checkout test-operator repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
     - name: Set latest tag for non main branch
       if: github.ref_name != 'main'
@@ -147,13 +147,13 @@ jobs:
         echo "latesttag=${BRANCH_NAME}-latest" >> $GITHUB_ENV
 
     - name: Install opm
-      uses: redhat-actions/openshift-tools-installer@v1
+      uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1
       with:
         source: github
         opm: 'latest'
 
     - name: Log in to Red Hat Registry
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1
       with:
         registry: ${{ env.imageregistry }}
         username: ${{ secrets.QUAY_USERNAME }}
@@ -173,7 +173,7 @@ jobs:
         INDEX_IMAGE: test-operator-index
 
     - name: Push test-operator-index To ${{ env.imageregistry }}
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
       with:
         image: test-operator-index
         tags: ${{ env.latesttag }} ${{ github.sha }}

.github/workflows/documentation.yaml

@@ -30,25 +30,25 @@ jobs:
     steps:
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Setup python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.14'
           cache: 'pip'
           cache-dependency-path: ./docs/requirements.txt
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
       - name: Build documentation
         run: |
           docs/build-docs.sh
       - name: Upload artifacts
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: docs/build/html/
   deploy:
@@ -62,4 +62,4 @@ jobs:
       - name: Deploy to GitHub Pages
         id: deployment
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/release-test-operator.yaml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
     - name: Tag image
-      uses: tinact/docker.image-retag@1.0.3
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/
         image_old_tag: ${{ github.sha }}
@@ -28,7 +28,7 @@ jobs:
         registry_password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Tag -bundle image
-      uses: tinact/docker.image-retag@1.0.3
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/-bundle
         image_old_tag: ${{ github.sha }}
@@ -38,7 +38,7 @@ jobs:
         registry_password: ${{ secrets.QUAY_PASSWORD }}
 
     - name: Tag -index image
-      uses: tinact/docker.image-retag@1.0.3
+      uses: tinact/docker.image-retag@684702232e2a3c29b4e5ca25d7d80f927d255c64 # 1.0.3
       with:
         image_name: ${{ env.imagenamespace }}/-index
         image_old_tag: ${{ github.sha }}