From caaa85b907abf693bac575a1565b0454fccce972 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 19 Jul 2022 06:05:56 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/automerge.yml         | 2 +-
 .github/workflows/pr-auditor.yml        | 4 ++--
 .github/workflows/update-tags.yml       | 6 +++---
 docker-compose/otel/docker-compose.yaml | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index c4165ba31..6d079b38a 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: automerge
-        uses: pascalgn/automerge-action@v0.12.0
+        uses: pascalgn/automerge-action@c9bd1823770819dc8fb8a5db2d11a3a95fbe9b07 # tag=v0.12.0
         env:
           # Allows this merge to trigger other actions
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/pr-auditor.yml b/.github/workflows/pr-auditor.yml
index 3fe422331..a5bda6e57 100644
--- a/.github/workflows/pr-auditor.yml
+++ b/.github/workflows/pr-auditor.yml
@@ -8,9 +8,9 @@ jobs:
   check-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # tag=v2
         with: { repository: 'sourcegraph/sourcegraph' }
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # tag=v2
         with: { go-version: '1.18' }
 
       - run: ./dev/pr-auditor/check-pr.sh
diff --git a/.github/workflows/update-tags.yml b/.github/workflows/update-tags.yml
index 09077bbf5..71ff1625f 100644
--- a/.github/workflows/update-tags.yml
+++ b/.github/workflows/update-tags.yml
@@ -11,8 +11,8 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # tag=v2
+      - uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # tag=v2
         with:
           go-version: "^1.18"
 
@@ -20,7 +20,7 @@ jobs:
       - name: Pin tags to ${{ github.event.inputs.semver }}
         run: tools/update-docker-tags.sh "${{ github.event.inputs.semver }}"
       - name: Open pull request
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@18f7dc018cc2cd597073088f7c7591b9d1c02672 # tag=v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: ${{ github.event.inputs.branch }}
diff --git a/docker-compose/otel/docker-compose.yaml b/docker-compose/otel/docker-compose.yaml
index 66ae3adeb..b0cd240cd 100644
--- a/docker-compose/otel/docker-compose.yaml
+++ b/docker-compose/otel/docker-compose.yaml
@@ -7,7 +7,7 @@ services:
   # Ports exposed to the public internet: none
   otel-collector:
     container_name: otel-collector
-    image: otel/opentelemetry-collector:0.54.0
+    image: otel/opentelemetry-collector:0.54.0@sha256:542e600353176b737caf1ee92c9b53555a43648c31d3e4fe99af69345e7a7312
     volumes:
       - '../otel-collector/config.yaml:/etc/otel-collector/config.yaml'
     cpus: 0.5