chore(deps): pin dependencies

.github/renovate.json

@@ -21,6 +21,19 @@
       "schedule": [
         "at any time"
       ]
+    },
+    {
+      "description": "docker-compose.yml keeps a persistent volume mounted at /var/lib/postgresql/data, and Postgres 18 changed the layout of that directory, so an existing volume fails to start. Hold this file on Postgres 17 until the compose file stops reusing the old data directory.",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "postgres"
+      ],
+      "matchFileNames": [
+        "docker-compose.yml"
+      ],
+      "allowedVersions": "<18"
     }
   ]
 }

.github/workflows/audit.yml

@@ -25,9 +25,9 @@ jobs:
     env:
       TAG: latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Manual Trivy Setup
-        uses: aquasecurity/setup-trivy@v0.3.1
+        uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567  # v0.3.1
         with:
           cache: true
       - name: Set environment variables

.github/workflows/test.yml

@@ -74,7 +74,7 @@ jobs:
       - name: Build Docker image for single platform
         run: ./script/release-workflow/docker-build.sh
 
-      - uses: KengoTODA/actions-setup-docker-compose@v1
+      - uses: KengoTODA/actions-setup-docker-compose@477353946803dd64eaa44008b865b6bfc88cab4e  # v1.2.4
         if: ${{ env.ACT }}
         name: Install `docker-compose` for use with https://github.com/nektos/act
         with:

Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.4.10-alpine3.24 AS base
+FROM ruby:3.4.10-alpine3.24@sha256:c5a5064d190055633011c03aa800170cc36945ff3afb5f6c915329f92d6f1e00 AS base
 
 # 1. Install target specific dependencies
 # - gcompat required for arm/arm64 (otherwise nokogiri breaks when viewing network graph)

Dockerfile-bundle-base

@@ -1,4 +1,4 @@
-FROM ruby:3.4.10-alpine3.24
+FROM ruby:3.4.10-alpine3.24@sha256:c5a5064d190055633011c03aa800170cc36945ff3afb5f6c915329f92d6f1e00
 
 # Installation path
 ENV HOME=/pact_broker

Dockerfile-package-base

@@ -1,4 +1,4 @@
-FROM ruby:3.4.10-alpine3.24
+FROM ruby:3.4.10-alpine3.24@sha256:c5a5064d190055633011c03aa800170cc36945ff3afb5f6c915329f92d6f1e00
 
 # Installation path
 ENV HOME=/app

Dockerfile.debian

@@ -1,4 +1,4 @@
-FROM ruby:3.4.10 AS base
+FROM ruby:3.4.10@sha256:2e9cf64044599b1c5ea7dd7c48bac0858633e6413065aa4beebbbf448e11e18f AS base
 
 FROM base AS base-amd64
 ENV SUPERCRONIC_SHA1SUM=712d2ece75da6f6e530192a151488578153e4e96

docker-compose-clean-cron.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres:18
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     environment:
@@ -15,7 +15,7 @@ services:
       - ${PWD}/docker/pg-dump.sql:/tmp/pg-dump.sql
 
   pact-broker:
-    image: pactfoundation/pact-broker:2.113.0-pactbroker2.107.1
+    image: pactfoundation/pact-broker:2.113.0-pactbroker2.107.1@sha256:f43692590707513ed59993de3e5d3b2c5408a0eb59a28d41e0f063800ec7e8a3
     ports:
       - 9393:9393
     depends_on:

docker-compose-clean.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres:18
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     environment:
@@ -15,7 +15,7 @@ services:
       - ${PWD}/docker/pg-dump.sql:/tmp/pg-dump.sql
 
   pact-broker:
-    image: pactfoundation/pact-broker:2.113.0-pactbroker2.107.1
+    image: pactfoundation/pact-broker:2.113.0-pactbroker2.107.1@sha256:f43692590707513ed59993de3e5d3b2c5408a0eb59a28d41e0f063800ec7e8a3
     ports:
       - 9393:9393
     depends_on:

docker-compose-debian.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres:18
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     # ports:

docker-compose-dev-migrate.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres:18
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     # ports:

docker-compose-dev.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres:18
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     # ports:

docker-compose-heroku.yml

@@ -7,7 +7,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     ports:
@@ -18,7 +18,7 @@ services:
       POSTGRES_DB: postgres
 
   pact-broker:
-    image: pactfoundation/pact-broker:2.113.0-pactbroker2.107.1
+    image: pactfoundation/pact-broker:2.113.0-pactbroker2.107.1@sha256:f43692590707513ed59993de3e5d3b2c5408a0eb59a28d41e0f063800ec7e8a3
     ports:
       - 9393:9393
     depends_on:

docker-compose-test-different-env-var-names.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     environment:
@@ -12,7 +12,7 @@ services:
       POSTGRES_DB: postgres
 
   pact-broker:
-    image: pactfoundation/pact-broker:latest
+    image: pactfoundation/pact-broker:latest@sha256:b584200e9f153bf5896930d006c89b0ebf45df57d96aa08f7c7f16bc8b0343d4
     depends_on:
       - postgres
     environment:

docker-compose-tests.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres
+    image: postgres:18@sha256:4ef4dbc939d61acea57712655ddb4b4ab27419c913f94cca0cd57cb3ea3c2280
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     environment:
@@ -12,7 +12,7 @@ services:
       POSTGRES_DB: postgres
 
   pact-broker:
-    image: pactfoundation/pact-broker:latest
+    image: pactfoundation/pact-broker:latest@sha256:b584200e9f153bf5896930d006c89b0ebf45df57d96aa08f7c7f16bc8b0343d4
     depends_on:
       - postgres
     environment:

docker-compose.yml

@@ -3,7 +3,7 @@ version: '3'
 
 services:
   postgres:
-    image: postgres:17
+    image: postgres:17@sha256:67f41722b7a8cbdb868a44a4995c846eddfdc2973bccb291ce937dce88ad5675
     healthcheck:
       test: psql postgres --command "select 1" -U postgres
     volumes:
@@ -14,7 +14,7 @@ services:
       POSTGRES_DB: postgres
 
   pact-broker:
-    image: pactfoundation/pact-broker:2.137.0-pactbroker2.118.0
+    image: pactfoundation/pact-broker:2.137.0-pactbroker2.118.0@sha256:02e4cb14d565bd88817248724c1476041276188100111409fef0c506e19ad4b3
     ports:
       - 9292:9292
     depends_on:
@@ -38,7 +38,7 @@ services:
   # one might use a reverse proxy in front of the broker,
   # and includes the use of a self-signed TLS certificate
   nginx:
-    image: nginx:alpine
+    image: nginx:1.31.5-alpine@sha256:72ba65eb42c10344912a84ff42408db7d34f2feb642204570ab8fc5ffd29f1d3
     depends_on:
       - pact-broker
     volumes:

example-k8s-deployment/infrastructure/docker-compose.yaml

@@ -3,7 +3,7 @@ version: '3.7'
 
 services:
   stackup-base:
-    image: realestate/stackup:1.9.0
+    image: realestate/stackup:1.9.0@sha256:cbb81941ec5a7d1c4a4cdc916a270cc20d5577d45a71cb8ea02b817fbcd147e5
     working_dir: /app
     volumes:
       - .:/app