Pin dependencies

.github/workflows/build-images-heavy.yml

@@ -76,15 +76,15 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Free runner disk space
-        uses: jlumbroso/free-disk-space@v1.3.1 # Renovate pins to digest
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 # Renovate pins to digest
         with:
           tool-cache: true
           docker-images: false
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
       # Login first: cache-from needs read; cache-to/push need write (main).
       - name: Login to ghcr.io
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: docker/login-action@v3 # Renovate pins to digest
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 # Renovate pins to digest
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/build-images.yml

@@ -71,7 +71,7 @@ jobs:
       # Only smoke-tested images ever reach the registry.
       - name: Login to ghcr.io
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/login-action@v3 # Renovate pins to digest
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 # Renovate pins to digest
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/e2e-hub.yml

@@ -42,11 +42,11 @@ jobs:
           enable-cache: true
           cache-dependency-glob: tests/uv.lock
       - name: Install flux CLI
-        uses: fluxcd/flux2/action@b1b4438ae9ce7ade20a3d6e5aae25cef60be9c94 # main
+        uses: fluxcd/flux2/action@65d975b490d1284cd1f341d0980e38c84d3aa6a9 # main
         with:
           version: 2.5.1
       - name: Create kind cluster
-        uses: helm/kind-action@v1.12.0 # Renovate pins to digest
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 # Renovate pins to digest
         with:
           cluster_name: af-e2e
       - name: Deploy hub stack

.github/workflows/pixi-check.yml

@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-      - uses: prefix-dev/setup-pixi@v0.9.0 # Renovate pins to digest
+      - uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6 # Renovate pins to digest
         with:
           run-install: false
       - name: Check lockfile consistency

.github/workflows/validate-manifests.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Install flux CLI
-        uses: fluxcd/flux2/action@b1b4438ae9ce7ade20a3d6e5aae25cef60be9c94 # main
+        uses: fluxcd/flux2/action@65d975b490d1284cd1f341d0980e38c84d3aa6a9 # main
         with:
           version: ${{ env.FLUX_VERSION }}
       - name: Install kubeconform