.gitea/workflows/pr-docker-deploy.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 1
 
@@ -80,7 +80,7 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Fetch base branch
         run: |
@@ -186,7 +186,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Show Docker‑related env vars
         run: |
@@ -236,7 +236,7 @@ jobs:
           echo "Compose files: $compose_list"
 
       - name: Docker Compose Dry Run
-        uses: cssnr/stack-deploy-action@v1.4.0
+        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
         with:
           mode: compose
           file: ${{ steps.compose_file_list.outputs.compose_list }}
@@ -265,7 +265,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Cache tea CLI
         id: cache-tea
@@ -309,7 +309,7 @@ jobs:
       REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           ref: main
 
@@ -345,7 +345,7 @@ jobs:
            echo ${COMPOSE_FILE_LIST}
 
       - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@v1.4.0
+        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
         with:
           mode: compose
           file: ${{ needs.docker-compose-dry-run.outputs.compose_file_list }}

.gitea/workflows/renovate-pr-deploy.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Install Vault
         uses: cpanato/vault-installer@main
@@ -152,7 +152,7 @@ jobs:
           notification_message: "Starting Docker Compose run..."
 
       - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@v1.4.0
+        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
         with:
           mode: compose
           file: ${{ steps.compose_file_list.outputs.compose_list }}

.gitea/workflows/renovate.yml

@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Renovate Run
         env:

docker-compose.misc.yml

@@ -13,7 +13,7 @@ services:
       HUB_URL: http://192.168.1.254:22220
     expose:
       - 45876
-    image: henrygd/beszel-agent:latest
+    image: henrygd/beszel-agent:latest@sha256:6684cf709493b3728e329daaa669c8c386e9c2da324ce4ba3ef0c55c370fdbe5
     network_mode: host
     restart: unless-stopped
     volumes:
@@ -44,7 +44,7 @@ services:
       TASKS: 0
       VOLUMES: 0
       LOG_LEVEL: debug
-    image: ghcr.io/tecnativa/docker-socket-proxy:latest
+    image: ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:3400c429c5f9e1b21d62130fb93b16e2e772d4fb7695bd52fc2b743800b9fe9e
     ports:
       - 2375:2375
     privileged: true
@@ -105,7 +105,7 @@ services:
     <<: *watchtower-monitor
   portainer-agent:
     container_name: portainer_agent
-    image: portainer/agent:latest
+    image: portainer/agent:latest@sha256:ff968fbc40c78f8a822e1e6007e9f0e451b05263fed0639d7e37cbf6f4666b13
     volumes:
       - /:/host
       - /var/lib/docker/volumes:/var/lib/docker/volumes
@@ -119,7 +119,7 @@ services:
     environment:
       ENV: prod
       SIGNOZ_LOG_ENDPOINT: http://192.168.1.254:8082
-    image: pavanputhra/logspout-signoz
+    image: pavanputhra/logspout-signoz@sha256:6da8ce12279a5262de8b2d5c083ce82d4c878c4eab702b4d328afe147ed7553b
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
@@ -146,7 +146,7 @@ services:
     expose:
       - 8080
     hostname: Benedikta
-    image: ghcr.io/containrrr/watchtower:latest
+    image: ghcr.io/containrrr/watchtower:latest@sha256:6dd50763bbd632a83cb154d5451700530d1e44200b268a4e9488fefdfcf2b038
     restart: unless-stopped
     volumes:
       - /etc/localtime:/etc/localtime:ro