chore(deps): pin dependencies

.gitea/workflows/artifacthub-metadata.yaml

@@ -10,7 +10,7 @@ jobs:
     name: "Upload artifacthub-repo.yml to OCI registry"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
       with:
         registry: ${{ github.server_url }}

.gitea/workflows/golang-linters.yaml

@@ -20,7 +20,7 @@ jobs:
         go: [ stable ]
         os: [ ubuntu-latest-amd64, ubuntu-latest-arm64 ]
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: ${{ matrix.go }}

.gitea/workflows/golang-tests.yaml

@@ -33,7 +33,7 @@ jobs:
         go: [ stable ]
         os: [ ubuntu-latest-amd64, ubuntu-latest-arm64 ]
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: ${{ matrix.go }}

.gitea/workflows/markdown-linters.yaml

@@ -13,7 +13,7 @@ jobs:
     name: "Run markdown linter"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -12,14 +12,14 @@ jobs:
     name: "Release application"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         fetch-depth: 0
     - name: Install curl
       run: apt-get update && apt-get install --yes curl
     - name: Install syft
       env:
-        SYFT_VERSION: "1.49.0" # renovate: datasource=github-releases depName=anchore/syft
+        SYFT_VERSION: "1.48.0" # renovate: datasource=github-releases depName=anchore/syft
       run: |
         OS="$(uname | tr '[:upper:]' '[:lower:]')"
         ARCH="$(dpkg --print-architecture)"
@@ -33,7 +33,7 @@ jobs:
         rm syft_${SYFT_VERSION}_${OS}_${ARCH}.deb
     - uses: volker-raschek/cosign-installer@7643eed6736a199595ed2a31e9979ec353a88adb # v4.1.3-rc3
       with:
-        cosign-release: "v3.1.2" # renovate: datasource=github-tags depName=sigstore/cosign
+        cosign-release: "v3.1.1" # renovate: datasource=github-tags depName=sigstore/cosign
     - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       with:
         image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest

.gitea/workflows/update-docker-hub-description.yaml

@@ -10,7 +10,7 @@ jobs:
   update-description-on-hub-docker-io:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}