ci: fix scorecard/pinned-dependencies findings (#967)

* fix scorecard/pinned-dependencies findings
* make renovate update go install
Signed-off-by: Fabian Kammel <fk@edgeless.systems>

.github/actions/e2e_kbench/action.yml

@@ -20,7 +20,7 @@ runs:
 
     - name: Install evaluation dependencies
       shell: bash
-      run: pip install -r .github/actions/e2e_kbench/evaluate/requirements.txt
+      run: pip install --require-hashes -r .github/actions/e2e_kbench/evaluate/requirements.txt
 
     - name: Checkout patched K-Bench
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0

.github/actions/e2e_kbench/evaluate/requirements.txt

@@ -1,2 +1,4 @@
-matplotlib==3.6.2
-numpy==1.23.5
+matplotlib==3.6.2 \
+    --hash=sha256:9347cc6822f38db2b1d1ce992f375289670e595a2d1c15961aacbe0977407dfc
+numpy==1.23.5 \
+    --hash=sha256:5e05b1c973a9f858c74367553e236f287e749465f773328c8ef31abe18f691e1

.github/runners/azure-cvm/azure-function/requirements.txt

@@ -2,8 +2,13 @@
 # The Python Worker is managed by Azure Functions platform
 # Manually managing azure-functions-worker may cause unexpected issues
 
-azure-functions
-azure-mgmt-resource==21.2.1
-azure-identity==1.12.0
-azure-mgmt-subscription==3.1.1
-azure-keyvault==4.2.0
+azure-functions==1.12.0 \
+    --hash=sha256:443b049652ede41e57a698230cc3848d20e5b53dff52bc4a636ee0820813f1b5
+azure-mgmt-resource==21.2.1 \
+    --hash=sha256:c6f6987e6f61f0cb23abc3fb3658770bae8d299a46834d43d4b20251495d3806
+azure-identity==1.12.0 \
+    --hash=sha256:2a58ce4a209a013e37eaccfd5937570ab99e9118b3e1acf875eed3a85d541b92
+azure-mgmt-subscription==3.1.1 \
+    --hash=sha256:38d4574a8d47fa17e3587d756e296cb63b82ad8fb21cd8543bcee443a502bf48
+azure-keyvault==4.2.0 \
+    --hash=sha256:16b29039244cbe8b940c98a0d795626d76d2a579cb9b8c559983ad208082c0de

.github/workflows/build-os-image-requirements.txt

@@ -0,0 +1,2 @@
+lief==0.12.2 \
+    --hash=sha256:8e97f109cf4a24ad37d8227b52cf878a58723abe7d88f0f3d5867c02d8ead49b

.github/workflows/build-os-image.yml

@@ -573,7 +573,7 @@ jobs:
       - name: Install dependencies
         run: |
           echo "::group::Install dependencies"
-          python -m pip install --user lief==0.12.2
+          python -m pip install --user --require-hashes -r .github/workflows/build-os-image-requirements.txt
           sudo apt-get update
           sudo apt-get install -y systemd-container # for systemd-dissect
           echo "::endgroup::"

.github/workflows/check-licenses.yml

@@ -29,7 +29,7 @@ jobs:
           cache: true
 
       - name: Install go-licenses
-        run: go install github.com/google/go-licenses@latest
+        run: go install github.com/google/go-licenses@0e0ec3a03d2277ffa8161963486f03bb58a6358c # v1.5.0
 
       - name: Check licenses
         run: hack/check-licenses.sh

.github/workflows/test-actionlint.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Install Actionlint
         shell: bash
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@latest
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@7fdc9630cc360ea1a469eed64ac6d78caeda1234 # v1.6.22
 
       - name: Run Actionlint
         shell: bash

.github/workflows/test-go-generate.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Install stringer
         shell: bash
-        run: go install golang.org/x/tools/cmd/stringer@latest
+        run: go install golang.org/x/tools/cmd/stringer@7db99dd12661adab9ce92e9b9633b6ef90867fad # v0.5.0
 
       - name: Get Go submodules
         id: submods

.github/workflows/test-govulncheck.yml

@@ -46,5 +46,5 @@ jobs:
       - name: Govulncheck
         shell: bash
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@6ad3e3d0781578532aaedbed543b25d7d586c746 # v0.0.0-20230110180137-6ad3e3d07815
           GOMEMLIMIT=5GiB govulncheck "$(go list -f '{{.Dir}}/...' -m | xargs)"

hack/azure-snp-report-verify/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:20.04 AS build
+FROM ubuntu:20.04@sha256:0e0402cd13f68137edb0266e1d2c682f217814420f2d43d300ed8f65479b14fb AS build
 RUN apt-get update && apt-get install -y \
   build-essential \
   libcurl4-openssl-dev \
@@ -10,7 +10,7 @@ RUN wget -q https://github.com/Azure/confidential-computing-cvm-guest-attestatio
   && touch Utils.h \
   && g++ -Os -I/usr/include/azguestattestation1 -oclient main.cpp -lazguestattestation
 
-FROM ubuntu:20.04 AS release
+FROM ubuntu:20.04@sha256:0e0402cd13f68137edb0266e1d2c682f217814420f2d43d300ed8f65479b14fb AS release
 COPY --from=build client azguestattestation1_1.0.2_amd64.deb /
 RUN apt-get update && apt-get install -y /azguestattestation1_1.0.2_amd64.deb
 ENTRYPOINT ["/client"]

renovate.json

@@ -224,7 +224,7 @@
     },
     {
       "fileMatch": [
-        "(^|\\/)versions.go$"
+        "versions.go$"
       ],
       "matchStrings": [
         " \"https:\\/\\/github\\.com\\/containernetworking\\/plugins\\/releases\\/download\\/(?<currentValue>[^\\/\\s\"]+)\\/[^\"]+\""
@@ -232,6 +232,16 @@
       "depNameTemplate": "containernetworking/plugins",
       "datasourceTemplate": "github-releases",
       "autoReplaceStringTemplate": " \"https://github.com/containernetworking/plugins/releases/download/{{{newValue}}}/cni-plugins-linux-amd64-{{{newValue}}}.tgz\""
+    },
+    {
+      "fileMatch": [
+        "\\.yaml$",
+        "\\.yml$"
+      ],
+      "matchStrings": [
+        "go install (?<depName>[^@]+?)@(?<currentValue>[0-9a-f]{40})"
+      ],
+      "datasourceTemplate": "go"
     }
   ]
 }