Merge pull request #40 from orange-cloudfoundry/renovate/pin-dependen…

…cies

Pin dependencies

.github/workflows/bump-version.yml

@@ -16,12 +16,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0 # Number of commits to fetch. 0 indicates all history for all branches and tags.
 
       - name: Bump version and push tag
-        uses: anothrNick/[email protected] # Don't use @master or @v1 unless you're happy to test the latest version
+        uses: anothrNick/github-tag-action@a2c70ae13a881faf2b4953baaa9e49731997ab36 # 1.67.0 # Don't use @master or @v1 unless you're happy to test the latest version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           WITH_V: false

.github/workflows/on-commits.yml

@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
 
       # TODO: add caching for cli downloads, see https://github.com/marketplace/actions/cache
       - name: Install bosh-cli
         #See https://github.com/marketplace/actions/install-a-binary-from-github-releases
-        uses: jaxxstorm/[email protected]
+        uses: jaxxstorm/action-install-gh-release@c5ead9a448b4660cf1e7866ee22e4dc56538031a # v1.10.0
         with:
           repo: cloudfoundry/bosh-cli
           tag: v7.4.0
@@ -33,7 +33,7 @@ jobs:
 
       - name: Install yq cli
         #See https://github.com/marketplace/actions/install-a-binary-from-github-releases
-        uses: jaxxstorm/[email protected]
+        uses: jaxxstorm/action-install-gh-release@c5ead9a448b4660cf1e7866ee22e4dc56538031a # v1.10.0
         with:
           repo: mikefarah/yq
           tag: v4.34.2
@@ -47,7 +47,7 @@ jobs:
       # and if clause https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsif
       - name: create bosh dev release
         id: create-bosh-release
-        uses: orange-cloudfoundry/bosh-release-action@v2 # will create dev release when pushed git ref is not a tag
+        uses: orange-cloudfoundry/bosh-release-action@8732ff085712d9980fc66e50892cb9c3d7a3f884 # v2 # will create dev release when pushed git ref is not a tag
         with:
           target_branch: ${{github.ref_name}}
         env:
@@ -63,14 +63,14 @@ jobs:
       # > to download artifact contents individually. One of the consequences of this limitation is that if a zip is
       # > uploaded during a workflow run and then downloaded from the UI, there will be a double zip created.
       - name: Archive bosh dev release tgz
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
         with:
           name: archive-bosh-dev-release-tgz
           path: |
             k3s-*.tgz
 
       - name: Bump version and push tag
-        uses: anothrNick/[email protected] # Don't use @master or @v1 unless you're happy to test the latest version
+        uses: anothrNick/github-tag-action@a2c70ae13a881faf2b4953baaa9e49731997ab36 # 1.67.0 # Don't use @master or @v1 unless you're happy to test the latest version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # if you don't want to set write permissions use a PAT token
           WITH_V: false

.github/workflows/on-tags.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
 
@@ -28,7 +28,7 @@ jobs:
 
       - name: create bosh release
         id: create-bosh-release
-        uses: orange-cloudfoundry/bosh-release-action@v2
+        uses: orange-cloudfoundry/bosh-release-action@8732ff085712d9980fc66e50892cb9c3d7a3f884 # v2
         if: success() && startsWith(github.ref, 'refs/tags/')
         with:
           target_branch: ${{github.ref_name}}-release
@@ -48,7 +48,7 @@ jobs:
       # see https://github.com/ncipollo/release-action
       - name: create github release
         id: create-github-release
-        uses: ncipollo/[email protected]
+        uses: ncipollo/release-action@6c75be85e571768fa31b40abf38de58ba0397db5 # v1.13.0
         with:
           tag: ${{ github.ref_name }}
           draft: false