chore(deps): pin dependencies

.woodpecker/push.yml

@@ -4,7 +4,7 @@ when:
 
 steps:
   - name: release
-    image: alpine
+    image: alpine@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
     commands:
       - apk add --no-cache git
       - ./scripts/release.sh
@@ -13,7 +13,7 @@ steps:
         from_secret: gitea_repo_token
 
   - name: docker
-    image: woodpeckerci/plugin-kaniko
+    image: woodpeckerci/plugin-kaniko@sha256:b88802ba66af95ee28a8ffde08715631ec2892e024b2c74e90e19f73a5c2c602
     depends_on: [release]
     settings:
       repo: ${CI_REPO_OWNER}/${CI_REPO_NAME}
@@ -25,7 +25,7 @@ steps:
       cleanup: true
 
   - name: helm
-    image: alpine/helm
+    image: alpine/helm@sha256:b5c85b997d83e89d9e8ff9215a14b03864274143981af45eb3fe729cdf782c73
     depends_on: [release]
     environment:
       GITEA_REGISTRY_TOKEN: