From 12eda5d8569d170155d9a9fc5e0c56aab38cf2ee Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 17:32:16 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/check.yml      | 4 ++--
 terraform/apps/forgejo-runner.tf | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 9058432..d5cef48 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
       - name: Run Terraform fmt
         run: |
           CONFIG_DIRS=$(find ./terraform -type d -maxdepth 1 -mindepth 1 ! -name "modules" -exec basename {} \;)
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hashicorp/setup-terraform@v4
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
       - name: Run Terraform validate
         run: |
           echo "{ \"token\": \"dummy\" }" > ./terraform/storage/certs/global_token.json
diff --git a/terraform/apps/forgejo-runner.tf b/terraform/apps/forgejo-runner.tf
index a8de30a..c0032c0 100644
--- a/terraform/apps/forgejo-runner.tf
+++ b/terraform/apps/forgejo-runner.tf
@@ -90,7 +90,7 @@ resource "kubernetes_stateful_set_v1" "forgejo_runner" {
         # Init Container matches the local node name to the specific generated secret
         init_container {
           name              = "config-setup"
-          image             = "busybox:latest"
+          image             = "busybox:latest@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d"
           image_pull_policy = "IfNotPresent"
 
           command = [
@@ -172,7 +172,7 @@ resource "kubernetes_stateful_set_v1" "forgejo_runner" {
 
         container {
           name              = "dind"
-          image             = "docker:dind"
+          image             = "docker:dind@sha256:66d292e5c26bd33a6f6f61cacb880de2186339a524ecba1ce098dbbaceed6515"
           image_pull_policy = "IfNotPresent"
 
           security_context {