chore(deps): pin dependencies

.github/workflows/build_linux_profiler.yml

@@ -20,7 +20,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -34,7 +34,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false

.github/workflows/build_managed_helper.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -25,7 +25,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

.github/workflows/build_tracing_packages.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -25,7 +25,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTracing
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages-OpenTracing
           path: ./Pyroscope/artifacts/package/release
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -44,7 +44,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTelemetry
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages-OpenTelemetry
           path: ./Pyroscope/artifacts/package/release

.github/workflows/tag_linux.yml

@@ -22,7 +22,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -59,7 +59,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -96,7 +96,7 @@ jobs:
         name: ['glibc', 'musl']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false

.github/workflows/tag_managed_helper.yml

@@ -18,7 +18,7 @@ jobs:
       RELEASE_VERSION: ${{  github.ref_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -29,7 +29,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

.github/workflows/tag_tracing_opentelemetry_helper.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -24,7 +24,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTelemetry
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

.github/workflows/tag_tracing_opentracing_helper.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-x64-small
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: 'true'
           persist-credentials: false
@@ -24,7 +24,7 @@ jobs:
       - run: dotnet build -c Release
         working-directory: Pyroscope/Pyroscope.OpenTracing
       - name: Publish NuGet packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: packages
           path: ./Pyroscope/artifacts/package/release

IntegrationTest/Dockerfile.load-generator

@@ -1,4 +1,4 @@
-FROM python:3.9
+FROM python:3.9@sha256:da5aee29682d12a6649f51c8d6f15b87deb3e6c524b923c41d0cb3304d07c913
 
 RUN pip3 install requests
 

Pyroscope.Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:11 AS builder
+FROM debian:11@sha256:ee239c601913c0d3962208299eef70dcffcb7aac1787f7a02f6d3e2b518755e6 AS builder
 
 
 RUN apt-get update && apt-get -y install cmake make git curl golang libtool wget
@@ -32,7 +32,7 @@ RUN mkdir build-${CMAKE_BUILD_TYPE} && \
 
 RUN cd build-${CMAKE_BUILD_TYPE} && make -j16 Pyroscope.Profiler.Native Datadog.Linux.ApiWrapper.x64
 
-FROM busybox:1.36.1-glibc
+FROM busybox:1.36.1-glibc@sha256:8fe66e6f43e59abc326f16fa4491708d15591c42a17486235e55fabf18ba5cb6
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux/Pyroscope.Profiler.Native.so /Pyroscope.Profiler.Native.so
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux/Datadog.Linux.ApiWrapper.x64.so /Pyroscope.Linux.ApiWrapper.x64.so
 

Pyroscope.musl.Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.15 AS builder
+FROM alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864 AS builder
 
 RUN apk add  \
             clang \
@@ -40,7 +40,7 @@ RUN mkdir build-${CMAKE_BUILD_TYPE} && \
 
 RUN cd build-${CMAKE_BUILD_TYPE} && make -j16 Pyroscope.Profiler.Native Datadog.Linux.ApiWrapper.x64
 
-FROM busybox:1.36.1-musl
+FROM busybox:1.36.1-musl@sha256:faeb06dde6421d3dd02f59896bf47a64820f995458a42388277382010d208e1e
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux-musl/Pyroscope.Profiler.Native.so /Pyroscope.Profiler.Native.so
 COPY --from=builder /profiler/profiler/_build/DDProf-Deploy/linux-musl/Datadog.Linux.ApiWrapper.x64.so /Pyroscope.Linux.ApiWrapper.x64.so
 

docker-compose-itest.yml

@@ -1,7 +1,7 @@
 services:
   pyroscope:
     platform: linux/amd64
-    image: grafana/pyroscope
+    image: grafana/pyroscope@sha256:8d14e14fbfe6de270773921c49d84b0e95b7a29a3e24cdab8fc3f18f48573670
     ports:
       - "4040:4040"
 
@@ -86,7 +86,7 @@ services:
       SERVICE_NAME: $SERVICE_NAME
 
   grafana:
-    image: grafana/grafana:latest
+    image: grafana/grafana:latest@sha256:70d9599b186ce287be0d2c5ba9a78acb2e86c1a68c9c41449454d0fc3eeb84e8
     environment:
       - GF_INSTALL_PLUGINS=grafana-pyroscope-app
       - GF_AUTH_ANONYMOUS_ENABLED=true

docker-compose.serverless.yml

@@ -84,7 +84,7 @@ services:
     - DUMMY_API_HOST=http://serverless-dummy-api:9005
 
   StartDependencies.Serverless:
-    image: andrewlock/wait-for-dependencies
+    image: andrewlock/wait-for-dependencies@sha256:5d87561de8c019c3954298f707c1f6d7087f620a1ce36c3ec38cdfbc1ec4066e
     depends_on:
     - serverless-lambda-no-param-sync
     - serverless-lambda-one-param-sync
@@ -1044,7 +1044,7 @@ services:
 
   # The serverless function calls this API, which always returns 200 OK
   serverless-dummy-api:
-    image: andrewlock/ok-api:latest
+    image: andrewlock/ok-api:latest@sha256:ca0149fef76574b72116add387a1b395e3bafc56cb58b5e45b3c825f742e3911
     ports:
     - "9005:9005"
     environment: