chore(deps): pin dependencies

.github/workflows/docker.yaml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
       - name: Set version
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         id: set_version
         with:
           script: |

.github/workflows/example_basic_test.yaml

@@ -8,17 +8,17 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           path: |
             ./k6/foundations/01.basic.js

.github/workflows/example_browser_test.yaml

@@ -8,19 +8,19 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
         with:
           browser: true
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           path: |
             ./k6/browser/01.basic.js

.github/workflows/example_cli_flags_test.yaml

@@ -8,17 +8,17 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           path: |
             ./k6/foundations/01.basic.js

.github/workflows/example_env_var.yaml

@@ -8,17 +8,17 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3355:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         env:
           BASE_URL: "http://localhost:3355"
         with:

.github/workflows/example_specific_k6_version.yaml

@@ -8,19 +8,19 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
         with:
           k6-version: '0.49.0'
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           cloud-run-locally: false
           path: |

.github/workflows/example_verify_scripts.yaml

@@ -8,17 +8,17 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
       - name: Verify test script
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           path: |
             ./k6/foundations/01.basic.js

.github/workflows/k6_browser_tests.yaml

@@ -8,20 +8,20 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
         with:
           browser: true
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           path: |
             ./k6/browser/*.js

.github/workflows/k6_tests.yaml

@@ -8,20 +8,20 @@ jobs:
 
     services:
       quickpizza:
-        image: ghcr.io/grafana/quickpizza-local:latest # zizmor: ignore[unpinned-images]
+        image: ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043 # zizmor: ignore[unpinned-images]
         ports:
           - 3333:3333
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Setup k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
         with:
           browser: true
       - name: Run k6 test
-        uses: grafana/run-k6-action@v1
+        uses: grafana/run-k6-action@c6b79182b9b666aa4f630f4a6be9158ead62536e # v1
         with:
           path: |
             ./k6/foundations/*.js

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:23.10.0-bullseye AS fe-builder
+FROM node:23.10.0-bullseye@sha256:b27a5ea0a7e96e6aea8625035262eb29ce9b47cf184ce09fc538280720176b6d AS fe-builder
 
 WORKDIR /app/pkg/web
 COPY pkg/web ./
@@ -12,7 +12,7 @@ ENV PUBLIC_BACKEND_WS_ENDPOINT=${PUBLIC_BACKEND_WS_ENDPOINT}
 RUN npm install && \
     npm run build
 
-FROM golang:1.24-bullseye AS builder
+FROM golang:1.24-bullseye@sha256:2cdc80dc25edcb96ada1654f73092f2928045d037581fa4aa7c40d18af7dd85a AS builder
 
 WORKDIR /app
 COPY . ./
@@ -21,7 +21,7 @@ COPY --from=fe-builder /app/pkg/web/build /app/pkg/web/build
 # with uses a different distribution of libc.
 RUN CGO_ENABLED=0 go build -o /bin/quickpizza ./cmd
 
-FROM gcr.io/distroless/static-debian11
+FROM gcr.io/distroless/static-debian11@sha256:1dbe426d60caed5d19597532a2d74c8056cd7b1674042b88f7328690b5ead8ed
 
 COPY --from=builder /bin/quickpizza /bin
 EXPOSE 3333 3334 3335

compose.grafana-cloud.microservices.yaml

@@ -11,7 +11,7 @@ x-quickpizza-env-common: &quickpizza-env-common
 name: quickpizza
 services:
   alloy:
-    image: grafana/alloy:v1.9.1
+    image: grafana/alloy:v1.9.1@sha256:b5fc87ff9a8941d6ed3ae5f099d9cb8598b3cd42fef9a8af128ed782258b4017
     container_name: alloy
     labels:
     - "service.type=instrumentation"
@@ -45,7 +45,7 @@ services:
       - ws
 
   catalog:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     container_name: catalog
     labels:
     - "service.type=application"
@@ -56,7 +56,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "catalog"
 
   config:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     container_name: config
     labels:
     - "service.type=application"
@@ -66,7 +66,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_INSTANCE_ID: "config"
       QUICKPIZZA_OTEL_SERVICE_NAME: "config"
   copy:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     container_name: copy
     labels:
     - "service.type=application"
@@ -77,7 +77,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "copy"
 
   public-api:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     container_name: public-api
     labels:
     - "service.type=application"
@@ -90,7 +90,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "public-api"
 
   recommendations:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     container_name: recommendations
     labels:
     - "service.type=application"
@@ -101,7 +101,7 @@ services:
       QUICKPIZZA_OTEL_SERVICE_NAME: "recommendations"
 
   ws:
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     container_name: ws
     labels:
     - "service.type=application"

compose.grafana-cloud.monolithic.yaml

@@ -1,6 +1,6 @@
 services:
   alloy:
-    image: grafana/alloy:v1.9.1
+    image: grafana/alloy:v1.9.1@sha256:b5fc87ff9a8941d6ed3ae5f099d9cb8598b3cd42fef9a8af128ed782258b4017
     container_name: alloy
     labels:
     - "service.type=instrumentation"
@@ -30,7 +30,7 @@ services:
   quickpizza:
     # The QUICKPIZZA_IMAGE env. variable enables the use of a locally built image,
     # created with `make docker-build`.
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     # Alloy reads `container_name` to relabel service name in telemetry. 
     container_name: quickpizza  
     labels:

compose.grafana-local-stack.monolithic.yaml

@@ -2,7 +2,7 @@ services:
   quickpizza:
     # The QUICKPIZZA_IMAGE env. variable enables the use of a locally built image,
     # created with `make docker-build`.
-    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest}
+    image: ${QUICKPIZZA_IMAGE:-ghcr.io/grafana/quickpizza-local:latest@sha256:9056a53caaedc6e81339ee37a879a8ab3473c4d2472b2344c621311281af8043}
     ports:
       - "3333:3333"
     environment:
@@ -13,12 +13,12 @@ services:
       # QUICKPIZZA_LOG_LEVEL: debug
 
   loki:
-    image: grafana/loki:3.4.3
+    image: grafana/loki:3.4.3@sha256:5fe9fa99e9a747297cdf0239a5b25d192d8f668bd6505b09beef4dffcab5aac2
     ports:
       - "3100:3100"
 
   prometheus:
-    image: prom/prometheus:v3.2.1
+    image: prom/prometheus:v3.2.1@sha256:6927e0919a144aa7616fd0137d4816816d42f6b816de3af269ab065250859a62
     command:
       - --web.enable-remote-write-receiver
       - --enable-feature=exemplar-storage
@@ -28,12 +28,12 @@ services:
       - "9090:9090"
 
   pyroscope:
-    image: grafana/pyroscope:1.14.0
+    image: grafana/pyroscope:1.14.0@sha256:0f63959ffcf217e7046d8f7a3d20cf6909f2924f885fc2f0eec58f87f9acf749
     ports:
       - "4040:4040"
 
   tempo:
-    image: grafana/tempo:2.8.1
+    image: grafana/tempo:2.8.1@sha256:bc9245fe3da4e63dc4c6862d9c2dad9bcd8be13d0ba4f7705fa6acda4c904d0e
     command: [ "-config.file=/etc/tempo.yaml" ]
     volumes:
       - ./alloy/local-tempo.yaml:/etc/tempo.yaml
@@ -56,7 +56,7 @@ services:
       - ./grafana:/etc/grafana/provisioning/
 
   alloy:
-    image: grafana/alloy:v1.9.1
+    image: grafana/alloy:v1.9.1@sha256:b5fc87ff9a8941d6ed3ae5f099d9cb8598b3cd42fef9a8af128ed782258b4017
     volumes:
       - "./alloy/local.alloy:/config.alloy:Z"
       - "./alloy/${ALLOY_FILE_NAME:-local.alloy}:/config.alloy:Z"