chore(deps): pin dependencies

Author: renovate[bot]

.github/workflows/build.yml

@@ -12,15 +12,15 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Install cosign
         uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
         with:
           cosign-release: v2.2.4
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/test.yml

@@ -6,13 +6,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
-      - uses: actions/cache@v4
+      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
         with:
           key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
           path: ~/.npm
@@ -25,7 +25,7 @@ jobs:
   validate_kustomize:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
     - name: Install kubectl
       run: |
         curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:lts-slim
+FROM node:lts-slim@sha256:5d1796c8abda8fa5a94ba4b5d039d412c7037945dc76698f6f44c9aa94d0e220
 
 # Install Playwright dependencies
 RUN apt-get update && apt-get install -y \

package-lock.json

@@ -11,10 +11,10 @@
     "test": "ts-standard"
   },
   "devDependencies": {
-    "@types/node": "^22.17.1",
-    "ts-standard": "^12.0.2",
-    "tsx": "^4.20.4",
-    "typescript": "~5.9.0"
+    "@types/node": "22.17.1",
+    "ts-standard": "12.0.2",
+    "tsx": "4.20.5",
+    "typescript": "5.9.2"
   },
   "dependencies": {
     "commander": "^13.1.0",