chore(deps): pin dependencies (#382)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/publish.yaml

@@ -11,7 +11,7 @@ on:
 
 env:
   # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-  ZARF_VERSION: v0.51.0
+  ZARF_VERSION: v0.55.2
   # renovate: datasource=github-tags depName=k3d-io/k3d versioning=semver-coerced
   K3D_VERSION: v5.8.3
 
@@ -25,17 +25,17 @@ jobs:
       package_tag: ${{ steps.build.outputs.package_tag }}
       package_file: ${{ steps.build.outputs.package_file }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to registry1
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: registry1.dso.mil
           username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
@@ -66,7 +66,7 @@ jobs:
           echo "package_file=${PACKAGE_FILE}" >> $GITHUB_OUTPUT
 
       - name: Upload package as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: zarf-init-package
           path: ${{ steps.build.outputs.package_file }}
@@ -79,10 +79,10 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Download package artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: zarf-init-package
 
@@ -129,17 +129,17 @@ jobs:
           - ""
           - gitea-registry1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to registry1
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: registry1.dso.mil
           username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
@@ -153,7 +153,7 @@ jobs:
 
       - name: Download package artifact (for default flavor)
         if: matrix.flavor == ''
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: zarf-init-package
 

.github/workflows/update-zarf-injector.yaml

@@ -15,7 +15,7 @@ jobs:
     if: github.actor == 'renovate[bot]' || github.event_name == 'workflow_dispatch' # Only run if the actor is Renovate bot or if manually triggered
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Log zarf-config.yaml contents
         run: |
@@ -82,7 +82,7 @@ jobs:
 
       - name: Sign and push changes using graphql
         if: env.changes == 'true'
-        uses: planetscale/[email protected].10
+        uses: planetscale/ghcommit-action@2675e0864d08c642df6064d3eb71d71452aeeb29 # v0.2.14
         with:
           commit_message: "Update Zarf injector version and shasums from upstream"
           repo: ${{ github.repository }}

.pre-commit-config.yaml

@@ -22,6 +22,6 @@ repos:
     hooks:
       - id: fix-smartquotes
   - repo: https://github.com/renovatebot/pre-commit-hooks
-    rev: 39.227.2
+    rev: 40.19.2
     hooks:
       - id: renovate-config-validator

zarf-config.yaml

@@ -6,7 +6,7 @@ package:
       agent_image_domain: registry1.dso.mil/
       agent_image: ironbank/opensource/defenseunicorns/zarf/zarf-agent
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-      agent_image_tag: v0.51.0
+      agent_image_tag: v0.55.2
 
       # Tag for the zarf injector binary to use
       injector_version: "2025-03-24"
@@ -20,4 +20,4 @@ package:
       registry_image_tag: 3.0.0
 
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/go-gitea/gitea
-      gitea_image: "registry1.dso.mil/ironbank/opensource/go-gitea/gitea:v1.23.6"
+      gitea_image: "registry1.dso.mil/ironbank/opensource/go-gitea/gitea:v1.23.8"

zarf.yaml

@@ -11,32 +11,32 @@ components:
     required: true
     import:
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-      url: oci://ghcr.io/zarf-dev/packages/init:v0.51.0
+      url: oci://ghcr.io/zarf-dev/packages/init:v0.55.2
 
   # Creates the temporary seed-registry
   - name: zarf-seed-registry
     required: true
     import:
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-      url: oci://ghcr.io/zarf-dev/packages/init:v0.51.0
+      url: oci://ghcr.io/zarf-dev/packages/init:v0.55.2
 
   # Creates the permanent registry
   - name: zarf-registry
     required: true
     import:
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-      url: oci://ghcr.io/zarf-dev/packages/init:v0.51.0
+      url: oci://ghcr.io/zarf-dev/packages/init:v0.55.2
 
   # Creates the pod+git mutating webhook
   - name: zarf-agent
     required: true
     import:
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-      url: oci://ghcr.io/zarf-dev/packages/init:v0.51.0
+      url: oci://ghcr.io/zarf-dev/packages/init:v0.55.2
 
   - name: git-server
     import:
       # renovate: datasource=docker depName=registry1.dso.mil/ironbank/opensource/defenseunicorns/zarf/zarf-agent
-      url: oci://ghcr.io/zarf-dev/packages/init:v0.51.0
+      url: oci://ghcr.io/zarf-dev/packages/init:v0.55.2
     only:
       flavor: gitea-registry1