From d6a28c91f883b58f4afeb49fb96197e6d3696855 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:07:36 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/ci.yml          | 4 ++--
 .github/workflows/dev-build.yml   | 4 ++--
 .github/workflows/prod-deploy.yml | 4 ++--
 .github/workflows/stage-build.yml | 4 ++--
 Dockerfile                        | 6 +++---
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2fd8206..cc2244c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,6 @@ permissions: read-all
 
 jobs:
   test:
-    uses: mitlibraries/.github/.github/workflows/python-uv-shared-test.yml@main
+    uses: mitlibraries/.github/.github/workflows/python-uv-shared-test.yml@ed81322385810830d3b88f73557e6e1f35ce062a # main
   lint:
-    uses: mitlibraries/.github/.github/workflows/python-uv-shared-lint.yml@main
+    uses: mitlibraries/.github/.github/workflows/python-uv-shared-lint.yml@ed81322385810830d3b88f73557e6e1f35ce062a # main
diff --git a/.github/workflows/dev-build.yml b/.github/workflows/dev-build.yml
index dad8161..489fb28 100644
--- a/.github/workflows/dev-build.yml
+++ b/.github/workflows/dev-build.yml
@@ -33,7 +33,7 @@ permissions:
 jobs:
   deploy:
     name: Dev Deploy
-    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-dev.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-dev.yml@ed81322385810830d3b88f73557e6e1f35ce062a # main
     secrets: inherit
     with:
       AWS_REGION: "us-east-1"
@@ -58,7 +58,7 @@ jobs:
     steps:
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCT_DEV }}:role/${{ env.GHA_ROLE }}
diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml
index a044ae3..da7e62b 100644
--- a/.github/workflows/prod-deploy.yml
+++ b/.github/workflows/prod-deploy.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-promote-prod.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-promote-prod.yml@ed81322385810830d3b88f73557e6e1f35ce062a # main
     secrets: inherit
     with:
       AWS_REGION: "us-east-1"
@@ -52,7 +52,7 @@ jobs:
     steps:
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCT_PROD }}:role/${{ env.GHA_ROLE }}
diff --git a/.github/workflows/stage-build.yml b/.github/workflows/stage-build.yml
index ca859ee..53f2acc 100644
--- a/.github/workflows/stage-build.yml
+++ b/.github/workflows/stage-build.yml
@@ -33,7 +33,7 @@ permissions:
 jobs:
   deploy:
     name: Stage Deploy
-    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-stage.yml@main
+    uses: mitlibraries/.github/.github/workflows/ecr-multi-arch-deploy-stage.yml@ed81322385810830d3b88f73557e6e1f35ce062a # main
     secrets: inherit
     with:
       AWS_REGION: "us-east-1"
@@ -58,7 +58,7 @@ jobs:
     steps:
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCT_STAGE }}:role/${{ env.GHA_ROLE }}
diff --git a/Dockerfile b/Dockerfile
index b14d29e..c626fe0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # ---- Build stage ----
-FROM public.ecr.aws/lambda/python:3.14 AS builder
+FROM public.ecr.aws/lambda/python:3.14@sha256:26763da113ef9245aeb3ec49a2840013661965771a5fe308945fdecad56cfae2 AS builder
 
-COPY --from=ghcr.io/astral-sh/uv:0.10.7 /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.10.7@sha256:edd1fd89f3e5b005814cc8f777610445d7b7e3ed05361f9ddfae67bebfe8456a /uv /uvx /bin/
 
 COPY pyproject.toml uv.lock ${LAMBDA_TASK_ROOT}/
 
@@ -12,7 +12,7 @@ RUN cd ${LAMBDA_TASK_ROOT} && \
 COPY . ${LAMBDA_TASK_ROOT}/
 
 # ---- Runtime stage ----
-FROM public.ecr.aws/lambda/python:3.14
+FROM public.ecr.aws/lambda/python:3.14@sha256:26763da113ef9245aeb3ec49a2840013661965771a5fe308945fdecad56cfae2
 
 COPY --from=builder ${LAMBDA_TASK_ROOT} ${LAMBDA_TASK_ROOT}