Pin dependencies (#209)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/build.yml

@@ -22,9 +22,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # v2
         with:
           php-version: ${{ matrix.php }}
       - name: Build
@@ -46,10 +46,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # v2
         with:
           php-version: ${{ matrix.php }}
 
@@ -67,9 +67,9 @@ jobs:
   pecl-package:
     runs-on: ubuntu-latest
     container:
-      image: php:8.3-cli
+      image: php:8.3-cli@sha256:a599bc74b464f3e31b5ad0b45839e2ac8ba689d8c92372e38f9e9a5a734c9a2c
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Package and copy
         run: |
@@ -78,7 +78,7 @@ jobs:
           pear package
           cp opentelemetry-*.tgz binaries/
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: opentelemetry-pecl
           path: ext/binaries/*.tgz
@@ -94,16 +94,16 @@ jobs:
         ts: ['ts', 'nts']
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Install PHP ${{ matrix.php }}-${{ matrix.ts }}
         id: setup-php-sdk
-        uses: php/setup-php-sdk@v0.11
+        uses: php/setup-php-sdk@474d4e386703a8bf269c41661c6b934a751a61bf # v0.11
         with:
           version: ${{ matrix.php }}
           arch: x64
           ts: ${{ matrix.ts }}
       - name: Install dependencies
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
         with:
           arch: x64
           toolset: ${{ steps.setup-php-sdk.outputs.toolset }}
@@ -139,7 +139,7 @@ jobs:
         run: |
           Get-ChildItem -Path binaries -Recurse -Force | ForEach-Object { $_.FullName }
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{env.BUILD_NAME}}
           path: ext\binaries\${{env.BUILD_NAME}}\${{env.BUILD_NAME}}.dll
@@ -154,17 +154,17 @@ jobs:
     continue-on-error: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: download-artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
           path: ext/artifacts
       - name: zip
         run: |
           cd artifacts
           find . -maxdepth 1 -type d -exec zip -jr {}.zip {} \;
       - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2
         with:
           generate_release_notes: true
           draft: true

.github/workflows/check-style.yml

@@ -7,9 +7,9 @@ jobs:
     name: Formatting Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Run clang-format style check
-        uses: jidicula/clang-format-action@v4.15.0
+        uses: jidicula/clang-format-action@4726374d1aa3c6aecf132e5197e498979588ebc8 # v4.15.0
         with:
           clang-format-version: '16'
           check-path: ext

.github/workflows/nightly.yml

@@ -19,8 +19,8 @@ jobs:
     if: github.repository == 'open-telemetry/opentelemetry-php-instrumentation'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # v2
         with:
           php-version: 8.5
       - name: Build

.github/workflows/publish-php-debug-images.yml

@@ -24,13 +24,13 @@ jobs:
     steps:
 
       - name: check out the repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -43,7 +43,7 @@ jobs:
           echo "Latest version in ${{ matrix.php-version }} is ${PHP_VERSION}"
 
       - name: Build and push ${{ env.PHP_VERSION }} as ${{ matrix.php-version }}-${{ matrix.os }} to ghcr.io
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           push: true
           file: docker/Dockerfile.${{ matrix.os }}

.github/workflows/split.yml

@@ -18,11 +18,11 @@ jobs:
     permissions:
       contents: write # required for pushing changes
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Split repositories
-        uses: docker://jderusse/gitsplit:latest
+        uses: docker://jderusse/gitsplit:latest@sha256:ca619e08d0608d7ab8067be02db13409ec63a0e241c6308be42593f0c0ac705d
         with:
           args: gitsplit
         env:

docker/Dockerfile.alpine

@@ -1,4 +1,4 @@
-ARG ALPINE_VERSION=alpine:3.20
+ARG ALPINE_VERSION=alpine:3.20@sha256:765942a4039992336de8dd5db680586e1a206607dd06170ff0a37267a9e01958
 FROM ${ALPINE_VERSION} AS builder
 WORKDIR /usr/src
 

docker/Dockerfile.debian

@@ -1,4 +1,4 @@
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:78d2f66e0fec9e5a39fb2c72ea5e052b548df75602b5215ed01a17171529f706
 WORKDIR /usr/src
 
 #clang-format, gdb, valgrind