chore(deps): pin dependencies

.github/workflows/docker.yaml

@@ -15,20 +15,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           push: true

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-slim AS deps
+FROM python:3.11-slim@sha256:b27df5841f3355e9473f9a516d38a6783b6c8dfeacaf2d14a240f443b368ddb6 AS deps
 
 WORKDIR /app
 
@@ -15,7 +15,7 @@ COPY pyproject.toml pdm.lock LICENSE /app/
 
 RUN pdm install --frozen-lockfile --prod --no-editable --no-self
 
-FROM python:3.11-slim AS model-download
+FROM python:3.11-slim@sha256:b27df5841f3355e9473f9a516d38a6783b6c8dfeacaf2d14a240f443b368ddb6 AS model-download
 
 COPY --from=deps /app/.venv /app/.venv
 
@@ -33,7 +33,7 @@ open_clip.create_model_and_transforms(
 print("Model weights cached.")
 EOF
 
-FROM python:3.11-slim AS runtime
+FROM python:3.11-slim@sha256:b27df5841f3355e9473f9a516d38a6783b6c8dfeacaf2d14a240f443b368ddb6 AS runtime
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libglib2.0-0 \