From 9b3ce7746321cb8569a183557253b4d5c0b605e4 Mon Sep 17 00:00:00 2001
From: "elastic-renovate-prod[bot]"
 <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
Date: Fri, 18 Sep 2026 20:43:43 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/build.yml                   |  4 ++--
 .github/workflows/issues.yml                  |  2 +-
 .github/workflows/multikernel-tester.yml      | 10 +++++-----
 contrib/libbpf/.github/workflows/build.yml    |  6 +++---
 contrib/libbpf/.github/workflows/cifuzz.yml   |  2 +-
 contrib/libbpf/.github/workflows/codeql.yml   |  6 +++---
 contrib/libbpf/.github/workflows/coverity.yml |  2 +-
 contrib/libbpf/.github/workflows/lint.yml     |  2 +-
 contrib/libbpf/.github/workflows/ondemand.yml |  2 +-
 contrib/libbpf/.github/workflows/pahole.yml   |  2 +-
 contrib/libbpf/.github/workflows/test.yml     |  2 +-
 docker/Dockerfile.builder                     |  4 ++--
 docker/Dockerfile.imagepack                   |  2 +-
 testing/kernel_builder/Dockerfile             |  2 +-
 14 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b01e7dce..5003f8ee 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
     name: Build
     runs-on: ${{ inputs.runner }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
         with:
           persist-credentials: false
       - name: Configure System
@@ -49,7 +49,7 @@ jobs:
         id: path-generator
         run: echo "PWD=$(pwd)" >> "$GITHUB_OUTPUT"
       - name: Archive Build Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: elastic-ebpf-${{ inputs.architecture }}
           path: ${{ steps.path-generator.outputs.PWD }}/artifacts-${{ inputs.architecture }}/elastic-ebpf-${{ steps.version-generator.outputs.ELASTIC_EBPF_VERSION }}-SNAPSHOT.tar.gz
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 9cded467..af72d1f9 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/add-to-project@v0.3.0
+      - uses: actions/add-to-project@a9f041ddd462ed185893ea1024cec954f50dbe42 # v0.3.0
         with:
           project-url: https://github.com/orgs/elastic/projects/765
           github-token: ${{ secrets.ELASTIC_PAT }}
diff --git a/.github/workflows/multikernel-tester.yml b/.github/workflows/multikernel-tester.yml
index e7facdf4..0e07bfdc 100644
--- a/.github/workflows/multikernel-tester.yml
+++ b/.github/workflows/multikernel-tester.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       with:
         persist-credentials: false
     - name: Install packages needed for testing
@@ -57,14 +57,14 @@ jobs:
     - name: Get Env
       run: echo "ELASTIC_EBPF_VERSION=$(cat VERSION)" >> $GITHUB_ENV && echo "PWD=$(pwd)" >> $GITHUB_ENV
     - name: Download Build Artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: elastic-ebpf-${{ inputs.architecture }}
         path: ${{ env.PWD }}/artifacts
     - name: Untar
       run: cd artifacts && tar -zxf elastic-ebpf-${ELASTIC_EBPF_VERSION}-SNAPSHOT.tar.gz
     - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
       with:
         go-version: '1.22'
     - name: Run tests
@@ -76,13 +76,13 @@ jobs:
         mkdir -p logs && mv testing/results logs/${{ matrix.kernel_flavor }}-${{ inputs.architecture }}
     - name: Archive test summary
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: result-summary-${{ matrix.kernel_flavor }}-${{ inputs.architecture }}.txt
         path: results-${{ matrix.kernel_flavor }}-${{ inputs.architecture }}.txt
     - name: Archive individual test results
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: logs-${{ matrix.kernel_flavor }}-${{ inputs.architecture }}.txt
         path: logs
diff --git a/contrib/libbpf/.github/workflows/build.yml b/contrib/libbpf/.github/workflows/build.yml
index d9697bad..ee270e9c 100644
--- a/contrib/libbpf/.github/workflows/build.yml
+++ b/contrib/libbpf/.github/workflows/build.yml
@@ -42,7 +42,7 @@ jobs:
           - name: gcc-12
             target: RUN_GCC12
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
         name: Checkout
       - uses: ./.github/actions/setup
         name: Setup
@@ -63,14 +63,14 @@ jobs:
           - arch: s390x
           - arch: x86
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
         name: Checkout
       - uses: ./.github/actions/setup
         name: Pre-Setup
       - run: source /tmp/ci_setup && sudo -E $CI_ROOT/managers/ubuntu.sh
         if: matrix.arch == 'x86'
         name: Setup
-      - uses: uraimo/run-on-arch-action@v2.0.5
+      - uses: uraimo/run-on-arch-action@cd5f294c3b7be88bc5b708fe25e1af36818f9ead # v2.0.5
         name: Build in docker
         if: matrix.arch != 'x86'
         with:
diff --git a/contrib/libbpf/.github/workflows/cifuzz.yml b/contrib/libbpf/.github/workflows/cifuzz.yml
index bcada62f..9cb47f85 100644
--- a/contrib/libbpf/.github/workflows/cifuzz.yml
+++ b/contrib/libbpf/.github/workflows/cifuzz.yml
@@ -33,7 +33,7 @@ jobs:
           dry-run: false
           sanitizer: ${{ matrix.sanitizer }}
       - name: Upload Crash
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@3446296876d12d4e3a0f3145a3c87e67bf0a16b5 # v1
         if: failure() && steps.build.outcome == 'success'
         with:
           name: ${{ matrix.sanitizer }}-artifacts
diff --git a/contrib/libbpf/.github/workflows/codeql.yml b/contrib/libbpf/.github/workflows/codeql.yml
index 5d3ecf36..9b88b938 100644
--- a/contrib/libbpf/.github/workflows/codeql.yml
+++ b/contrib/libbpf/.github/workflows/codeql.yml
@@ -32,10 +32,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
         with:
           languages: ${{ matrix.language }}
           queries: +security-extended,security-and-quality
@@ -49,4 +49,4 @@ jobs:
           make -C ./src
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
diff --git a/contrib/libbpf/.github/workflows/coverity.yml b/contrib/libbpf/.github/workflows/coverity.yml
index 8caa8ad9..3f849a66 100644
--- a/contrib/libbpf/.github/workflows/coverity.yml
+++ b/contrib/libbpf/.github/workflows/coverity.yml
@@ -11,7 +11,7 @@ jobs:
     if: github.repository == 'libbpf/libbpf'
     name: Coverity
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - uses: ./.github/actions/setup
       - name: Run coverity
         run: |
diff --git a/contrib/libbpf/.github/workflows/lint.yml b/contrib/libbpf/.github/workflows/lint.yml
index 35e70918..67669d87 100644
--- a/contrib/libbpf/.github/workflows/lint.yml
+++ b/contrib/libbpf/.github/workflows/lint.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
         env:
diff --git a/contrib/libbpf/.github/workflows/ondemand.yml b/contrib/libbpf/.github/workflows/ondemand.yml
index 6cd46e5b..17f5b4d4 100644
--- a/contrib/libbpf/.github/workflows/ondemand.yml
+++ b/contrib/libbpf/.github/workflows/ondemand.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     name: vmtest with customized pahole/Kernel
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - uses: ./.github/actions/setup
       - uses: ./.github/actions/vmtest
         with:
diff --git a/contrib/libbpf/.github/workflows/pahole.yml b/contrib/libbpf/.github/workflows/pahole.yml
index 37840ff0..7425f5f1 100644
--- a/contrib/libbpf/.github/workflows/pahole.yml
+++ b/contrib/libbpf/.github/workflows/pahole.yml
@@ -12,7 +12,7 @@ jobs:
     env:
       STAGING: tmp.master
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - uses: ./.github/actions/setup
       - uses: ./.github/actions/vmtest
         with:
diff --git a/contrib/libbpf/.github/workflows/test.yml b/contrib/libbpf/.github/workflows/test.yml
index 1e7224c7..058836c5 100644
--- a/contrib/libbpf/.github/workflows/test.yml
+++ b/contrib/libbpf/.github/workflows/test.yml
@@ -31,7 +31,7 @@ jobs:
             runs_on: s390x
             arch: 's390x'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
         name: Checkout
       - uses: ./.github/actions/setup
         name: Setup
diff --git a/docker/Dockerfile.builder b/docker/Dockerfile.builder
index a7e97009..74cbe463 100644
--- a/docker/Dockerfile.builder
+++ b/docker/Dockerfile.builder
@@ -8,7 +8,7 @@ ARG SCRATCH=/misc/scratch
 # a static bpftool on a newer ubuntu and copy it to centos7
 # builder image to generate skeleton headers.
 
-FROM docker.io/ubuntu:jammy as bpftool-builder
+FROM docker.io/ubuntu:jammy@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02 as bpftool-builder
 ARG SCRATCH
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -30,7 +30,7 @@ RUN CFLAGS=-static make -C $SCRATCH/kernel/tools/bpf/bpftool
 
 
 # Stage 2: Centos 7 ebpf-builder
-FROM docker.io/centos:7 as ebpf-builder
+FROM docker.io/centos:7@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4 as ebpf-builder
 ARG SCRATCH
 RUN mkdir -p $SCRATCH
 
diff --git a/docker/Dockerfile.imagepack b/docker/Dockerfile.imagepack
index 7373352d..c4f3be8c 100644
--- a/docker/Dockerfile.imagepack
+++ b/docker/Dockerfile.imagepack
@@ -1,4 +1,4 @@
-FROM docker.io/ubuntu:latest
+FROM docker.io/ubuntu:latest@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78
 ARG IMGPACK_FILTER=
 COPY / /kernel-img-repository/${IMGPACK_FILTER}
 
diff --git a/testing/kernel_builder/Dockerfile b/testing/kernel_builder/Dockerfile
index 7a165d79..c972c90e 100644
--- a/testing/kernel_builder/Dockerfile
+++ b/testing/kernel_builder/Dockerfile
@@ -1,4 +1,4 @@
-from debian:bullseye
+from debian:bullseye@sha256:6f519a81440354a85eb592c5f32109ab80605f6b892455983a6f618bf87fabe9
 
 RUN dpkg --add-architecture arm64
 RUN apt-get -y update