chore(deps): pin dependencies

.github/actions/deploy/action.yaml

@@ -23,7 +23,7 @@ runs:
   using: 'composite'
   steps:
     - name: Configure AWS credentials from Websites account
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
       with:
         role-to-assume: ${{ inputs.aws_role }}
         aws-region: eu-west-1

.github/actions/install/action.yaml

@@ -4,7 +4,7 @@ description: Install dependencies, build and test project
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
       with:
         node-version: '18'
     - name: Installing dependencies

.github/workflows/build.yaml

@@ -11,8 +11,8 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: '18'
       - name: Install deps, build and test project

.github/workflows/codeql.yml

@@ -27,10 +27,10 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3

.github/workflows/deploy-docker.yml

@@ -21,9 +21,9 @@ jobs:
       # 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       # Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: '18'
       - name: Installing dependencies

.github/workflows/pull-request.yml

@@ -15,8 +15,8 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: '18'
       - name: Install deps, build and test project
@@ -31,7 +31,7 @@ jobs:
           cloudfront_distribution_id: ${{ secrets.CLOUDFRONT_ID_TEST }}
           cloudfront_invalidation_paths: '/preview/${{ github.event.number }}/*'
       - name: Adding comment to PR with preview link and validation results
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             github.rest.issues.createComment({

Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:alpine3.18-slim
+FROM nginx:alpine3.18-slim@sha256:b841779b72c127bdcb6e58b2ae3d810f890e020460858d84c7bd38d15cf26ddf
 
 RUN mkdir -p /opt/empathy
 WORKDIR /opt/empathy