Zet Docker en GitHub actions dependencies vast

ericwout-overheid · ericwout-overheid · commit 3bb44409ecbb · 2026-01-15T14:42:35.000+01:00
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -12,3 +12,7 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+  - package-ecosystem: "github-actions"
+    directory: /
+    schedule:
+      interval: "monthly"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -73,6 +73,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.10
         with:
           sarif_file: results.sarif
diff --git a/src/main/docker/Dockerfile.jvm b/src/main/docker/Dockerfile.jvm
@@ -78,7 +78,7 @@
 #   accessed directly. (example: "foo.example.com,bar.example.com")
 #
 ###
-FROM registry.access.redhat.com/ubi9/openjdk-21:1.23
+FROM registry.access.redhat.com/ubi9/openjdk-21:1.23@sha256:668700248b0abc5cf6d06948c32b6670557ffac39dfe4ea93ab889313453ac39
 
 ENV LANGUAGE='en_US:en'
 
diff --git a/src/main/docker/Dockerfile.legacy-jar b/src/main/docker/Dockerfile.legacy-jar
@@ -78,7 +78,7 @@
 #   accessed directly. (example: "foo.example.com,bar.example.com")
 #
 ###
-FROM registry.access.redhat.com/ubi9/openjdk-21:1.23
+FROM registry.access.redhat.com/ubi9/openjdk-21:1.23@sha256:668700248b0abc5cf6d06948c32b6670557ffac39dfe4ea93ab889313453ac39
 
 ENV LANGUAGE='en_US:en'
 
diff --git a/src/main/docker/Dockerfile.native b/src/main/docker/Dockerfile.native
@@ -16,7 +16,7 @@
 # The ` registry.access.redhat.com/ubi9/ubi-minimal:9.6` base image is based on UBI 9.
 # To use UBI 8, switch to `quay.io/ubi8/ubi-minimal:8.10`.
 ###
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7
 WORKDIR /work/
 RUN chown 1001 /work \
     && chmod "g+rwX" /work \
diff --git a/src/main/docker/Dockerfile.native-micro b/src/main/docker/Dockerfile.native-micro
@@ -19,7 +19,7 @@
 # The `quay.io/quarkus/ubi9-quarkus-micro-image:2.0` base image is based on UBI 9.
 # To use UBI 8, switch to `quay.io/quarkus/quarkus-micro-image:2.0`.
 ###
-FROM quay.io/quarkus/ubi9-quarkus-micro-image:2.0
+FROM quay.io/quarkus/ubi9-quarkus-micro-image:2.0@sha256:85bcd8c2784a8eb2589c65b1eda75f0dd1aeca5c2f7fc9374544cda954eef791
 WORKDIR /work/
 RUN chown 1001 /work \
     && chmod "g+rwX" /work \

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@`
`78`	`78`	`# accessed directly. (example: "foo.example.com,bar.example.com")`
`79`	`79`	`#`
`80`	`80`	`###`
`81`		`-FROM registry.access.redhat.com/ubi9/openjdk-21:1.23`
	`81`	`+FROM registry.access.redhat.com/ubi9/openjdk-21:1.23@sha256:668700248b0abc5cf6d06948c32b6670557ffac39dfe4ea93ab889313453ac39`
`82`	`82`
`83`	`83`	`ENV LANGUAGE='en_US:en'`
`84`	`84`