Merge branch 'main' into chore/GHA-240508-stepsecurity-remediation

marcalff · web-flow · commit ef711c7b0a8a · 2025-04-25T17:42:38.000+02:00
diff --git a/.devcontainer/Dockerfile.conan b/.devcontainer/Dockerfile.conan
@@ -1,6 +1,6 @@
 # Copyright The OpenTelemetry Authors
 # SPDX-License-Identifier: Apache-2.0
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02
 
 RUN apt update && apt install -y \
 	build-essential \
@@ -19,7 +19,7 @@ RUN apt update && apt install -y \
 	libtool \
 	python3-pip
 
-RUN pip install conan --break-system-packages
+RUN pip install "conan==2.15.1" --break-system-packages
 
 ARG USER_UID=1000
 ARG USER_GID=1000
@@ -52,4 +52,4 @@ WORKDIR  /workspaces/opentelemetry-cpp
 
 ENTRYPOINT []
 
-CMD ["/bin/bash"]
+CMD ["/bin/bash"]
diff --git a/.devcontainer/Dockerfile.dev b/.devcontainer/Dockerfile.dev
@@ -47,7 +47,7 @@ ENV IS_CONTAINER_BUILD=true
 
 COPY ./.devcontainer/customize_container.sh /tmp/opentelemetry_cpp/devcontainer/customize_container.sh
 RUN /tmp/opentelemetry_cpp/devcontainer/customize_container.sh
-RUN apt install -y npm && npm install -g markdownlint-cli
+RUN apt install -y npm && npm install -g markdownlint-cli@0.44.0
 
 USER devuser
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # main March 2025
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # main March 2025
         with:
           name: benchmark_results
           path: benchmarks
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -916,7 +916,7 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: install markdownlint-cli
-      run: sudo npm install -g markdownlint-cli
+      run: sudo npm install -g markdownlint-cli@0.44.0
 
     - name: run markdownlint
       run: markdownlint .
@@ -985,7 +985,7 @@ jobs:
       - name: install dependencies
         run: |
           sudo apt update && sudo apt install python3-pip
-          sudo pip3 install aiohttp
+          sudo pip3 install aiohttp==3.11.18
       - name: run w3c trace-context test suite
         env:
           SPEC_LEVEL: 1
diff --git a/.github/workflows/cmake_install.yml b/.github/workflows/cmake_install.yml
@@ -212,8 +212,8 @@ jobs:
           submodules: 'recursive'
       - name: Install Conan
         run: |
-          python3 -m pip install --upgrade pip
-          pip install "conan>=2.0,<3"
+          python3 -m pip install pip==25.0.1
+          pip install "conan==2.15.1"
           conan profile detect --force
       - name: Install or build all dependencies with Conan
         run: |
@@ -250,8 +250,8 @@ jobs:
           submodules: 'recursive'
       - name: Install Conan
         run: |
-          python3 -m pip install --upgrade pip
-          pip install "conan>=2.0,<3"
+          python3 -m pip install pip==25.0.1
+          pip install "conan==2.15.1"
           conan profile detect --force
       - name: Install or build all dependencies with Conan
         run: |
diff --git a/docker/ubuntuLatest/Dockerfile b/docker/ubuntuLatest/Dockerfile
@@ -1,8 +1,9 @@
 # Copyright The OpenTelemetry Authors
 # SPDX-License-Identifier: Apache-2.0
 
-FROM ubuntu:latest
+FROM ubuntu:latest@sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02
 ENV DEBIAN_FRONTEND=noninteractive
+
 WORKDIR /work
 
 #install grpc and abseil
diff --git a/functional/otlp/Dockerfile b/functional/otlp/Dockerfile
@@ -1,7 +1,7 @@
 # Copyright The OpenTelemetry Authors
 # SPDX-License-Identifier: Apache-2.0
 
-FROM otel/opentelemetry-collector
+FROM otel/opentelemetry-collector:0.123.0@sha256:c8e36258c1b26927fb7b05c5186b90e9c3d77315efc24f65d6fddec1c14b60b3
 COPY . .
 CMD ["--config", "/otel-cpp/otel-config.yaml"]
 EXPOSE 4317
