chore(deps): pin dependencies

.gitea/workflows/release-image.yaml

@@ -18,29 +18,21 @@ on:
         default: false
 
 jobs:
-  debug:
-    runs-on: ubuntu-js
-    steps:
-      - name: Dump Context
-        run: |
-          echo "Event Name: ${{ github.event_name }}";
-          echo "Input Value: ${{ inputs['directus-release'] }}";
-
   build:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: release
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.3.0
         with:
           node-version: 24.14.1
 
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: 1.3.12
 
@@ -48,7 +40,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Cache Astro Build
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: |
             .astro
@@ -83,12 +75,12 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: release
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.12.13'
 
@@ -120,15 +112,15 @@ jobs:
     needs: [ build, guarddog ]
     runs-on: ubuntu-js
     if: |
-      github.event_name != 'workflow_dispatch' ||
+      (github.event_name == 'push') || 
-      github.event.inputs['directus-release'] == 'true'
+      (github.event_name == 'workflow_dispatch' && github.event.inputs['directus-release'] == 'true')
     outputs:
       new-release-published: ${{ steps.semantic.outputs.new-release-published }}
       new-release-version: ${{ steps.semantic.outputs.new-release-version }}
       new-release-git-tag: ${{ steps.semantic.outputs.new-release-git-tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
           token: ${{ secrets.BOT_TOKEN }}
@@ -141,12 +133,12 @@ jobs:
           git commit --allow-empty -m "fix(content): directus published update [skip ci]"
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.3.0
         with:
           node-version: 24.14.1
 
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: 1.3.12
 
@@ -168,19 +160,19 @@ jobs:
     if: ${{ needs.semantic-release.outputs.new-release-published == 'true' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: release
 
       - name: Login to Harbor Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.1.0
         with:
           registry: ${{ vars.REGISTRY_HOST }}
           username: ${{ vars.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_SECRET }}
 
       - name: Login to Docker
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.1.0
         with:
           registry: ${{ vars.DH_REGISTRY }}
           username: ${{ secrets.DH_USERNAME }}
@@ -193,7 +185,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.0.0
         with:
           driver: kubernetes
           driver-opts: |
@@ -208,7 +200,7 @@ jobs:
 
       - name: Extract Metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v6.0.0
         with:
           images: |
             ${{ vars.REGISTRY_HOST }}/images/site-profile
@@ -221,7 +213,7 @@ jobs:
             type=semver,pattern={{major}},value=${{ needs.semantic-release.outputs.new-release-version }}
 
       - name: Build and Push Image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.1.0
         with:
           context: .
           push: true
@@ -272,19 +264,19 @@ jobs:
       needs.semantic-release.outputs.new-release-published == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: release
 
       - name: Login to Gitea Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.1.0
         with:
           registry: ${{ vars.REPOSITORY_HOST }}
           username: ${{ gitea.actor }}
           password: ${{ secrets.REPOSITORY_TOKEN }}
 
       - name: Login to Docker
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.1.0
         with:
           registry: ${{ vars.DH_REGISTRY }}
           username: ${{ secrets.DH_USERNAME }}
@@ -297,7 +289,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.0.0
         with:
           driver: kubernetes
           driver-opts: |
@@ -312,7 +304,7 @@ jobs:
 
       - name: Extract Metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v6.0.0
         with:
           images: |
             ${{ vars.REPOSITORY_HOST }}/${{ gitea.repository }}
@@ -325,7 +317,7 @@ jobs:
             type=semver,pattern={{major}},value=${{ needs.semantic-release.outputs.new-release-version }}
 
       - name: Build and Push Image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.1.0
         with:
           context: .
           push: true

.gitea/workflows/renovate.yaml

@@ -12,7 +12,7 @@ jobs:
     container: ghcr.io/renovatebot/renovate:43
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Renovate
         run: renovate

.gitea/workflows/test-build.yaml

@@ -17,15 +17,15 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.3.0
         with:
           node-version: 24.14.1
 
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: 1.3.12
 
@@ -33,7 +33,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Cache Astro Build Cache
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: |
             .astro
@@ -67,10 +67,10 @@ jobs:
     runs-on: ubuntu-js
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.12.13'