chore(deps): pin dependencies

.woodpecker/pr.yml

@@ -3,25 +3,25 @@ when:
 
 steps:
   - name: install
-    image: node:24-slim
+    image: node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2
     depends_on: []
     commands:
       - npm ci
 
   - name: lint
-    image: node:24-slim
+    image: node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2
     depends_on: [install]
     commands:
       - npm run lint
 
   - name: test
-    image: node:24-slim
+    image: node:24-slim@sha256:a81a03dd965b4052269a57fac857004022b522a4bf06e7a739e25e18bce45af2
     depends_on: [install]
     commands:
       - npm run test
 
   - name: e2e
-    image: mcr.microsoft.com/playwright:v1.58.2-noble
+    image: mcr.microsoft.com/playwright:v1.58.2-noble@sha256:6446946a1d9fd62d9ae501312a2d76a43ee688542b21622056a372959b65d63d
     depends_on: [install]
     commands:
       - ./scripts/gen-dev-cert.sh
@@ -30,7 +30,7 @@ steps:
       NODE_TLS_REJECT_UNAUTHORIZED: "0"
 
   - name: docker-build
-    image: woodpeckerci/plugin-kaniko
+    image: woodpeckerci/plugin-kaniko@sha256:b88802ba66af95ee28a8ffde08715631ec2892e024b2c74e90e19f73a5c2c602
     depends_on: []
     settings:
       repo: ${CI_REPO_OWNER}/${CI_REPO_NAME}