Fix KasmVNC QuPath CI and branch isolation

Co-authored-by: Florian Wuennemann <flowuenne@gmail.com>

Author: cursoragent

.github/workflows/docker-pr.yml

@@ -15,46 +15,20 @@ jobs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Detect changed Dockerfiles
         id: changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
         with:
           filters: |
-            ttyd:
-              - 'ttyd/**'
-            streamlit:
-              - 'streamlit/**'
-            cellxgene:
-              - 'cellxgene/**'
-            shiny:
-              - 'shiny-simple-example/**'
-            marimo:
-              - 'marimo/**'
             kasmvnc_qupath:
               - '.seqera/**'
-              - 'kasmVNC/qupath/**'
 
       - name: Set matrix
         id: set-matrix
         run: |
           CONTAINERS="[]"
-          if [[ "${{ steps.changes.outputs.ttyd }}" == "true" ]]; then
-            CONTAINERS=$(echo "$CONTAINERS" | jq -c '. + [{"name":"ttyd","path":"./ttyd"}]')
-          fi
-          if [[ "${{ steps.changes.outputs.streamlit }}" == "true" ]]; then
-            CONTAINERS=$(echo "$CONTAINERS" | jq -c '. + [{"name":"streamlit","path":"./streamlit"}]')
-          fi
-          if [[ "${{ steps.changes.outputs.cellxgene }}" == "true" ]]; then
-            CONTAINERS=$(echo "$CONTAINERS" | jq -c '. + [{"name":"cellxgene","path":"./cellxgene"}]')
-          fi
-          if [[ "${{ steps.changes.outputs.shiny }}" == "true" ]]; then
-            CONTAINERS=$(echo "$CONTAINERS" | jq -c '. + [{"name":"shiny","path":"./shiny-simple-example"}]')
-          fi
-          if [[ "${{ steps.changes.outputs.marimo }}" == "true" ]]; then
-            CONTAINERS=$(echo "$CONTAINERS" | jq -c '. + [{"name":"marimo","path":"./marimo"}]')
-          fi
           if [[ "${{ steps.changes.outputs.kasmvnc_qupath }}" == "true" ]]; then
             CONTAINERS=$(echo "$CONTAINERS" | jq -c '. + [{"name":"kasmvnc-qupath","path":"./.seqera"}]')
           fi
@@ -75,28 +49,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804
         with:
           images: ${{ env.REGISTRY }}/${{ github.repository }}/development
           tags: |
             type=ref,event=pr,prefix=${{ matrix.container.name }}-pr
 
       - name: Build and push ${{ matrix.container.name }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
         with:
           context: ${{ matrix.container.path }}
           push: true
@@ -112,7 +86,7 @@ jobs:
           echo "ref=${{ fromJSON(steps.meta.outputs.json).tags[0] }}" >> $GITHUB_OUTPUT
 
       - name: Run security scan
-        uses: aquasecurity/trivy-action@0.31.0
+        uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37
         with:
           image-ref: ${{ steps.scanref.outputs.ref }}
           format: "table"
@@ -133,7 +107,7 @@ jobs:
           fi
 
       - name: Upload security scan results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         if: always()
         with:
           name: trivy-scan-${{ matrix.container.name }}-${{ github.run_id }}
@@ -151,7 +125,7 @@ jobs:
           echo "- **Commit**: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
 
       - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           script: |
             const fs = require('fs');

.github/workflows/docker-release.yml

@@ -8,11 +8,6 @@ on:
         required: true
         type: choice
         options:
-          - ttyd
-          - streamlit
-          - cellxgene
-          - shiny
-          - marimo
           - kasmvnc-qupath
       version:
         description: 'Version to release (e.g., 1.0.0)'
@@ -37,33 +32,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set container path
         id: container
         run: |
           case "${{ inputs.container }}" in
-            ttyd) echo "path=./ttyd" >> "$GITHUB_OUTPUT" ;;
-            streamlit) echo "path=./streamlit" >> "$GITHUB_OUTPUT" ;;
-            cellxgene) echo "path=./cellxgene" >> "$GITHUB_OUTPUT" ;;
-            shiny) echo "path=./shiny-simple-example" >> "$GITHUB_OUTPUT" ;;
-            marimo) echo "path=./marimo" >> "$GITHUB_OUTPUT" ;;
             kasmvnc-qupath) echo "path=./.seqera" >> "$GITHUB_OUTPUT" ;;
           esac
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804
         with:
           images: ${{ env.REGISTRY }}/${{ github.repository }}/${{ inputs.container }}
           tags: |
@@ -74,7 +64,7 @@ jobs:
             org.opencontainers.image.licenses=MIT
 
       - name: Build and push ${{ inputs.container }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
         with:
           context: ${{ steps.container.outputs.path }}
           push: true
@@ -87,7 +77,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=${{ inputs.container }}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8
         with:
           tag_name: ${{ inputs.container }}/${{ inputs.version }}
           name: ${{ inputs.container }} ${{ inputs.version }}