Pin dependencies

pulumi-renovate[bot] · web-flow · commit 53ddc3ae39e7 · 2025-09-12T17:27:26.000Z
diff --git a/infra/providers/package-lock.json b/infra/providers/package-lock.json
diff --git a/infra/providers/package.json b/infra/providers/package.json
@@ -1,7 +1,7 @@
 {
     "name": "pulumi-provider-repos",
     "devDependencies": {
-        "@types/node": "^18"
+        "@types/node": "18.19.31"
     },
     "dependencies": {
         "@pulumi/github": "6.7.3",
diff --git a/provider-ci/internal/pkg/templates/base/.devcontainer/Dockerfile b/provider-ci/internal/pkg/templates/base/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/internal/pkg/templates/base/.github/actions/setup-tools/action.yml b/provider-ci/internal/pkg/templates/base/.github/actions/setup-tools/action.yml
@@ -60,7 +60,7 @@ runs:
     #{{- if .Config.InstallKubectl }}#
 
     - name: Install kubectl
-      uses: azure/setup-kubectl@v4
+      uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
       with:
         version: 'latest'
       id: install
diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml
@@ -58,7 +58,7 @@ jobs:
       #{{- .Config | renderEscStep | indent 6 }}#
       # Without ldid cross-compiling Node binaries on a Linux worker intended to work on darwin-arm64 fails to sign the
       # binaries properly and they do not work as expected. See https://github.com/pulumi/pulumi-awsx/issues/1490
-      - uses: MOZGIII/install-ldid-action@v1
+      - uses: MOZGIII/install-ldid-action@d5ab465f3a66a4d60a59882b935eb30e18e8d043 # v1
         with:
           tag: v2.1.5-procursus2
       - name: Setup tools
@@ -79,7 +79,7 @@ jobs:
         run: |
           echo "path=$(go env GOMODCACHE)" >> "${GITHUB_OUTPUT}"
       - name: Go Cache
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
         with:
           path: |
             ${{ steps.gocache.outputs.path }}
diff --git a/provider-ci/internal/pkg/templates/internal-bridged/.github/workflows/copilot-setup-steps.yml b/provider-ci/internal/pkg/templates/internal-bridged/.github/workflows/copilot-setup-steps.yml
@@ -28,7 +28,7 @@ jobs:
     # If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           persist-credentials: false
 
diff --git a/provider-ci/internal/pkg/templates/internal/.github/workflows/export-repo-secrets.yml b/provider-ci/internal/pkg/templates/internal/.github/workflows/export-repo-secrets.yml
@@ -8,7 +8,7 @@ jobs:
     steps:
       - name: Generate a GitHub token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: 1256780 # Export Secrets GitHub App
           private-key: ${{ secrets.EXPORT_SECRETS_PRIVATE_KEY }}
diff --git a/provider-ci/test-providers/acme/.devcontainer/Dockerfile b/provider-ci/test-providers/acme/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/test-providers/aws/.devcontainer/Dockerfile b/provider-ci/test-providers/aws/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/test-providers/cloudflare/.devcontainer/Dockerfile b/provider-ci/test-providers/cloudflare/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/test-providers/docker/.devcontainer/Dockerfile b/provider-ci/test-providers/docker/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/test-providers/eks/.devcontainer/Dockerfile b/provider-ci/test-providers/eks/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/test-providers/terraform-module/.devcontainer/Dockerfile b/provider-ci/test-providers/terraform-module/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code
diff --git a/provider-ci/test-providers/xyz/.devcontainer/Dockerfile b/provider-ci/test-providers/xyz/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM jetpackio/devbox:latest
+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
 
 # Installing your devbox project
 WORKDIR /code

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "pulumi-provider-repos",`
`3`	`3`	`"devDependencies": {`
`4`		`- "@types/node": "^18"`
	`4`	`+ "@types/node": "18.19.31"`
`5`	`5`	`},`
`6`	`6`	`"dependencies": {`
`7`	`7`	`"@pulumi/github": "6.7.3",`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM jetpackio/devbox:latest`
	`1`	`+FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7`
`2`	`2`
`3`	`3`	`# Installing your devbox project`
`4`	`4`	`WORKDIR /code`