chore(deps): pin dependencies (#206)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: bo0tzz <git@bo0tzz.me>

.github/workflows/build-postgres.yml

@@ -23,11 +23,11 @@ jobs:
         matrix: ${{ steps.get-versions.outputs.result }}
     steps:
         - name: Checkout to repository
-          uses: actions/checkout@v4
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
         - id: get-versions
           name: Get dependency versions
-          uses: mikefarah/yq@v4.45.2
+          uses: mikefarah/yq@734e2cd25402f10f51351c4034625043f07e7b06 # v4.45.3
           with:
             cmd: yq eval -o=json -I=0 postgres/versions.yaml
 
@@ -56,18 +56,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.6.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -88,7 +88,7 @@ jobs:
           fi
 
       - name: Determine image push
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: should-release
         with:
           script: |
@@ -97,7 +97,7 @@ jobs:
             return "${{ steps.changed-version.outputs.any_changed }}" == "true";
 
       - name: Determine latest version of VectorChord in matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: latest-vchord
         env:
           VERSION_MATRIX: ${{ needs.pre-job.outputs.matrix }}
@@ -109,7 +109,7 @@ jobs:
             return latest;
 
       - name: Determine latest version of pgvector in matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         id: latest-pgvector
         env:
           VERSION_MATRIX: ${{ needs.pre-job.outputs.matrix }}
@@ -122,7 +122,7 @@ jobs:
 
       - name: Generate docker image tags
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           flavor: |
             # Disable latest tag

.github/workflows/build-server-base.yml

@@ -40,7 +40,7 @@ jobs:
   
   build_and_push:
     needs: pre-job
-    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@a6c9d08f2c3a5d7773ecc209cdde4b910d70cdb3
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@7c66ef5e95c10c2abe187a478ba51e3021e17b2d
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     strategy:
       fail-fast: true

.github/workflows/tag-server-base.yml

@@ -15,13 +15,13 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: "main"
           fetch-depth: 0