Updated Dockerfile, python deps and npm package to use pinned depende…

…ncies

.github/workflows/doc-to-pdf.yml

@@ -19,15 +19,15 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install doc requirements
-        run: pip install -r docs/requirements.txt
+        run: pip install --no-cache-dir --require-hashes -r docs/requirements.txt
       - name: Install chromium
         run: sudo apt install chromium-browser
       - name: Install node
         uses: actions/setup-node@v3
         with:
           node-version: 18
       - name: Install puppeteer
-        run: npm i --save puppeteer
+        run: cd docs && npm install
       - name: Run mkdocs serve in background
         run: mkdocs serve & sleep 10
       - name: Run pdf script

.github/workflows/push-doc.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install doc requirements
-        run: pip install -r docs/requirements.txt
+        run: pip install --no-cache-dir --require-hashes -r docs/requirements.txt
       - name: Push doc
         run: mike deploy --update-aliases --push --no-redirect ${{ inputs.VERSION }} ${{ inputs.ALIAS }}
       - name: Set default doc

.github/workflows/staging-create-infra.yml

@@ -36,7 +36,7 @@ jobs:
           python-version: "3.11"
           cache: "pip"
       - name: Install ansible
-        run: pip install ansible
+        run: pip install --no-cache-dir --require-hashes -r misc/requirements-ansible.txt
         if: inputs.TYPE != 'k8s'
       - name: Install ansible libs
         run: ansible-galaxy install --timeout 120 monolithprojects.github_actions_runner,1.18.1 && ansible-galaxy collection install --timeout 120 community.general

.github/workflows/staging-tests.yml

@@ -42,7 +42,7 @@ jobs:
         run: docker tag local/bunkerweb-tests:latest 192.168.42.100:5000/bunkerweb-tests:latest && docker push 192.168.42.100:5000/bunkerweb-tests:latest && docker tag local/scheduler-tests:latest 192.168.42.100:5000/scheduler-tests:latest && docker push 192.168.42.100:5000/scheduler-tests:latest && docker tag local/autoconf-tests:latest 192.168.42.100:5000/autoconf-tests:latest && docker push 192.168.42.100:5000/autoconf-tests:latest
         if: inputs.TYPE == 'swarm'
       - name: Install test dependencies
-        run: pip3 install -r tests/requirements.txt
+        run: pip3 install --no-cache-dir --require-hashes -r tests/requirements.txt
       - uses: actions/download-artifact@v3
         with:
           name: tf-k8s

.github/workflows/test-core-linux.yml

@@ -91,5 +91,5 @@ jobs:
       - name: Run tests
         run: |
           cd ./tests/core/${{ inputs.TEST }}
-          MAKEFLAGS="-j $(nproc)" find . -name "requirements.txt" -exec pip install -r {} \;
+          MAKEFLAGS="-j $(nproc)" find . -name "requirements.txt" -exec pip install --no-cache-dir --require-hashes -r {} \;
           ./test.sh "linux"

.github/workflows/tests-ui-linux.yml

@@ -99,7 +99,7 @@ jobs:
       - name: Run tests
         run: |
           cd ./tests/ui
-          MAKEFLAGS="-j $(nproc)" find . -name "requirements.txt" -exec pip install -r {} \;
+          MAKEFLAGS="-j $(nproc)" find . -name "requirements.txt" -exec pip install --no-cache-dir --require-hashes -r {} \;
           touch test.txt
           zip test.zip test.txt
           rm test.txt

docs/Dockerfile

@@ -1,4 +1,4 @@
-FROM squidfunk/mkdocs-material
+FROM squidfunk/mkdocs-material@sha256:e5f28aa0c3ac8206f93e44a0c52ea85616b0d6c674319cd1d87a241594788355
 
 COPY mkdocs.yml /docs
 COPY docs /docs/docs