Pin dependencies

.github/workflows/conftest.yaml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Conftest
         uses: redhat-cop/github-actions/confbatstest@master

.github/workflows/install-test.yaml

@@ -16,22 +16,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout 🛎️
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       with:
         fetch-depth: 0
 
     - name: Setup Helm 🧰
-      uses: azure/setup-helm@v3
+      uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
       with:
         version: v3.5.1
 
     - name: Setup Python 🐍
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
       with:
         python-version: 3.7
 
     - name: Setup chart-testing 🧰
-      uses: helm/[email protected]
+      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
 
     - name: Find changed Charts 🔎
       id: changed-charts
@@ -43,7 +43,7 @@ jobs:
         fi
 
     - name: Setup kind cluster 🧰
-      uses: helm/[email protected]
+      uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
       with:
         version: v0.20.0
       if: steps.changed-charts.outputs.changed == 'true'

.github/workflows/lint-test.yaml

@@ -15,22 +15,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout 🛎️
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       with:
         fetch-depth: 0
 
     - name: Setup Helm 🧰
-      uses: azure/setup-helm@v3
+      uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
       with:
         version: v3.5.1
 
     - name: Setup Python 🐍
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
       with:
         python-version: 3.7
 
     - name: Setup chart-testing 🧰
-      uses: helm/[email protected]
+      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
 
     - name: Run Chart lint tests 🧪
       run: ct lint

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
 
@@ -24,7 +24,7 @@ jobs:
           git config user.email "[email protected]"
 
       - name: Install Helm
-        uses: azure/[email protected]
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
         with:
           version: latest 
 
@@ -34,6 +34,6 @@ jobs:
           helm repo add incubator https://charts.helm.sh/incubator
 
       - name: Run chart-releaser
-        uses: helm/[email protected]
+        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

charts/argocd-operator/values.yaml

@@ -62,7 +62,7 @@ argocd_cr:
     size: 1
   ha:
     enabled: false
-    redisProxyImage: haproxy
+    redisProxyImage: haproxy@sha256:938a990aaa19dfc1c09c5cb056e90dabddfa1c0cdf106c0246e248d7ee14219d
     redisProxyVersion: "2.0.4"
 
   rbac:

charts/owncloud/values.yaml

@@ -6,12 +6,12 @@ image:
     repository: quay.io/eformat/owncloud-oauth
     pullPolicy: IfNotPresent
   redis:
-    image: docker.io/redis:5.0
-    healthimage: docker.io/healthcheck/redis:latest
+    image: docker.io/redis:5.0@sha256:fc5ecd863862f89f04334b7cbb57e93c9790478ea8188a49f6e57b0967d38c75
+    healthimage: docker.io/healthcheck/redis:latest@sha256:06127d640e5c092f4707e3506e3a80c0361225b8da735b54d66e162a79d1fa38
     pullPolicy: Always
   mariadb:
-    image: docker.io/mariadb:10.4
-    healthimage: docker.io/healthcheck/mysql:latest
+    image: docker.io/mariadb:10.4@sha256:ad9c054d56170384b8ac0d36a0f7835b38cabdc741d2197a223d2bd28032a89b
+    healthimage: docker.io/healthcheck/mysql:latest@sha256:b7a7b38485b0d93bfc12a42f870dcf8b27c9ba854c9a28d4d26ed941a113ee20
     pullPolicy: Always
 
 nameOverride: ""

charts/sonarqube/values.yaml

@@ -26,7 +26,7 @@ deploymentStrategy: {}
 
 image:
   repository: *name
-  tag: 9.9.1-community
+  tag: 9.9.1-community@sha256:846d343e43181bfc9898269005e13bf269f8cfcdb1a0ce98321bd562d3ebe12b
   # If using a private repository, the name of the imagePullSecret to use
   # pullSecret: my-repo-secret
 

charts/static-site/alpine-curl-git.Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine/git:v2.24.1
+FROM alpine/git:v2.24.1@sha256:90185bacaffa02db620e907e34aeb5b53bbd85ace77f97db453355171c8f20d1
 RUN apk add --no-cache curl
 
 ENTRYPOINT ["/bin/sh"]

charts/tekton-demo/templates/tasks/task-git-clone.yaml

@@ -108,7 +108,7 @@ spec:
 
   steps:
     - name: clone
-      image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.17.1
+      image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.17.1@sha256:a39b8c647d6eaf609dc04bc7b0fc0f787b3b25fd6b1c9b182066a5c29a64a18c
       script: |
         #!/bin/sh
         set -eu -o pipefail

charts/tekton-demo/templates/tasks/task-github.yaml

@@ -15,7 +15,7 @@ spec:
       type: string
   steps:
     - name: update-github
-      image: registry.access.redhat.com/ubi8/ubi:latest
+      image: registry.access.redhat.com/ubi8/ubi:latest@sha256:449da7f8f2ef6285a8445a1e31af57a97b9dae5dcf009b1629c59742c89c68c3
       env:
         - name: GITHUBTOKEN
           valueFrom: