From 77f3f8fda1243e0c75f64c33862dbdf50f6f8fc2 Mon Sep 17 00:00:00 2001
From: "renovate-pagopa[bot]"
 <164534245+renovate-pagopa[bot]@users.noreply.github.com>
Date: Mon, 3 Jun 2024 04:43:17 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/ci.yml                | 28 ++++++++++++-------------
 src/it/resources/docker-compose-it.yaml |  4 ++--
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4b44ad2b..0ddd78cd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,19 +26,19 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           fetch-depth: 0
 
       - name: Setup Java (temurin@11)
         if: matrix.java == 'temurin@11'
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@91d3aa4956ec4a53e477c4907347b5e3481be8c9 # v2
         with:
           distribution: temurin
           java-version: 11
 
       - name: Cache sbt
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: |
             ~/.sbt
@@ -50,7 +50,7 @@ jobs:
           key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
 
       - name: Install node 16
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
         with:
           node-version: 16
 
@@ -64,7 +64,7 @@ jobs:
         run: tar cf targets.tar target generated/target models/target client/target project/target
 
       - name: Upload target directories
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2
         with:
           name: target-${{ matrix.os }}-${{ matrix.scala }}-${{ matrix.java }}
           path: targets.tar
@@ -85,19 +85,19 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           fetch-depth: 0
 
       - name: Setup Java (temurin@11)
         if: matrix.java == 'temurin@11'
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@91d3aa4956ec4a53e477c4907347b5e3481be8c9 # v2
         with:
           distribution: temurin
           java-version: 11
 
       - name: Cache sbt
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: |
             ~/.sbt
@@ -109,7 +109,7 @@ jobs:
           key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
 
       - name: Download target directories (2.13.10)
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2
         with:
           name: target-${{ matrix.os }}-2.13.10-${{ matrix.java }}
 
@@ -119,7 +119,7 @@ jobs:
           rm targets.tar
 
       - name: Install node 16
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
         with:
           node-version: 16
 
@@ -129,13 +129,13 @@ jobs:
       - name: Get 1.0.x-SNAPSHOTS versionIds
         id: version
         if: github.ref == 'refs/heads/1.0.x'
-        uses: castlabs/get-package-version-id-action@v2.0
+        uses: castlabs/get-package-version-id-action@61097d3d0b65fa880de6de674e8b70e1fff6730b # v2.0
         with:
           version: 1.0.x-SNAPSHOT
 
       - name: Deleting 1.0.x-SNAPSHOTS versions
         if: ${{ github.ref == 'refs/heads/1.0.x' && steps.version.outputs.ids != '' }}
-        uses: actions/delete-package-versions@v2
+        uses: actions/delete-package-versions@000223ef3eaa3505c63d4c610f57ef103bcab46d # v2
         with:
           package-version-ids: ${{ steps.version.outputs.ids }}
 
@@ -146,7 +146,7 @@ jobs:
         run: sbt ++${{ matrix.scala }} publish
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1
         with:
           aws-region: eu-central-1
           role-to-assume: 'arn:aws:iam::505630707203:role/interop-github-ecr-dev'
@@ -154,7 +154,7 @@ jobs:
 
       - name: Login to Amazon ECR
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v1
+        uses: aws-actions/amazon-ecr-login@2fc7aceee09e9e4a7105c0d060c656fad0b4f63d # v1
 
       - name: Build, tag, and push image to Amazon ECR
         env:
diff --git a/src/it/resources/docker-compose-it.yaml b/src/it/resources/docker-compose-it.yaml
index 68914154..3740a954 100644
--- a/src/it/resources/docker-compose-it.yaml
+++ b/src/it/resources/docker-compose-it.yaml
@@ -1,7 +1,7 @@
 version: '3.0'
 services:
   postgres:
-    image: postgres:10.6
+    image: postgres:10.6@sha256:1bd46192a12a1012d52f41186c83dc343b4b2d07ad9836fb37a08cdf22041537
     ports:
       - '54329:5432'
     environment:
@@ -11,7 +11,7 @@ services:
     volumes:
       - ./postgre_init.sql:/docker-entrypoint-initdb.d/postgre_init.sql
   mongo:
-    image: mongo:4.0.28
+    image: mongo:4.0.28@sha256:4ca81c89ad08f4cfa9906005126112bffe8fb363800466ef5e50f6238f6f6af1
     ports:
       - '27019:27017'
     environment: