chore(deps): pin dependencies

.github/workflows/build.yml

@@ -32,15 +32,15 @@ jobs:
 
     steps:
       - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@v9
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Restore ccache
         # Don't use cache on releases as github does not allow it
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         with:
           path: ccache
           key: ccache-${{ matrix.arch }}-${{ github.sha }}
@@ -83,7 +83,7 @@ jobs:
           mv ${{ matrix.arch }}/kernel-debuginfo-*.rpm debuginfo/
 
       - name: Upload Kernel to action
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
         with:
           name: kernel-f${{ matrix.fedora_version}}-${{ matrix.arch }}
           path: |
@@ -92,7 +92,7 @@ jobs:
           compression-level: 7
 
       - name: Upload Kernel debuginfo to action
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
         with:
           name: kernel-f${{ matrix.fedora_version}}-${{ matrix.arch }}-debuginfo
           path: |
@@ -115,7 +115,7 @@ jobs:
           sudo podman run --rm -v $(pwd)/x86_64:/workspace arch_builder makepkg -s
 
       - name: Upload Kernel arch package to action
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
         if: matrix.arch == 'x86_64' && matrix.fedora_version == env.arch_fedora
         with:
           name: linux-f${{ matrix.fedora_version }}-arch
@@ -125,7 +125,7 @@ jobs:
 
       - name: Upload Kernel to release
         if: github.event_name == 'release'
-        uses: Wandalen/[email protected]
+        uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -144,7 +144,7 @@ jobs:
       - name: Backup ccache
         # Don't use cache on releases as github does not allow it
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         with:
           path: ccache
           key: ccache-${{ matrix.arch }}-${{ github.sha }}
@@ -157,7 +157,7 @@ jobs:
     steps:
       - name: Make release latest
         if: github.event.release.prerelease == false
-        uses: Wandalen/[email protected]
+        uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/publish-aur.yml

@@ -35,7 +35,7 @@ jobs:
     environment: prod
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Create PKGBUILD dir
         run: mkdir -p ./pkg/
       - name: Build PKGBUILD
@@ -60,7 +60,7 @@ jobs:
       - name: Echo PKGBUILD
         run: cat ./pkg/PKGBUILD
       - name: Publish AUR package
-        uses: KSXGitHub/[email protected]
+        uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
         with:
           pkgname: linux-bazzite-bin
           pkgbuild: ./pkg/PKGBUILD

Dockerfile

@@ -1,4 +1,4 @@
-ARG FEDORA_VERSION=41
+ARG FEDORA_VERSION=41@sha256:3ec60eb34fa1a095c0c34dd37cead9fd38afb62612d43892fcf1d3425c32bc1e
 
 FROM fedora:${FEDORA_VERSION}
 

Dockerfile-arch

@@ -1,4 +1,4 @@
-FROM archlinux:base-devel
+FROM archlinux:base-devel@sha256:61b9b05cf6a7a42aa1a32f0b00c92dcfc0b6acf3af2db1b86ab29f6605b21401
 
 ARG UID=1000
 ARG GID=1000