Fix Codacy audit findings: Docker, CI, deps, and dev tools

.github/workflows/ci-alerter.yml

@@ -18,7 +18,7 @@ jobs:
         runs-on: ubuntu-latest
         strategy:
             matrix:
-                go-version: ['1.26']
+                go-version: ['1.26.2']
                 postgres-version: ['14', '15', '16', '17', '18']
             fail-fast: false
 
@@ -38,16 +38,16 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Set up Go ${{ matrix.go-version }}
-              uses: actions/setup-go@v6
+              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
               with:
                   go-version: ${{ matrix.go-version }}
                   cache: false
 
             - name: Cache Go modules
-              uses: actions/cache@v5
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       ~/go/pkg/mod
@@ -65,20 +65,20 @@ jobs:
               run: go mod download
 
             - name: Lint alerter code
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: alerter
               run: |
                   go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
                   echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
                   make lint
 
             - name: Run go vet
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: alerter/src
               run: go vet ./...
 
             - name: Check formatting
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: alerter
               run: |
                   gofmt -l ./src > /tmp/gofmt.out
@@ -111,22 +111,22 @@ jobs:
               run: make coverage
 
             - name: Generate coverage report
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: alerter/src
               run: |
                   go tool cover -func=coverage.out
 
             - name: Upload build artifact
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
-              uses: actions/upload-artifact@v7
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: ai-dba-alerter-linux-amd64
                   path: alerter/ai-dba-alerter
                   retention-days: 7
 
             - name: Upload coverage artifact
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
-              uses: actions/upload-artifact@v7
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: alerter-coverage
                   path: |

.github/workflows/ci-client.yml

@@ -27,10 +27,10 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Set up Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   node-version: ${{ matrix.node-version }}
                   cache: 'npm'
@@ -56,15 +56,15 @@ jobs:
 
             - name: Upload build artifact
               if: matrix.node-version == '20'
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: ai-dba-client-dist
                   path: client/dist/
                   retention-days: 7
 
             - name: Upload coverage artifact
               if: matrix.node-version == '20'
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: client-coverage
                   path: client/coverage/

.github/workflows/ci-collector.yml

@@ -18,7 +18,7 @@ jobs:
         runs-on: ubuntu-latest
         strategy:
             matrix:
-                go-version: ['1.26']
+                go-version: ['1.26.2']
                 postgres-version: ['14', '15', '16', '17', '18']
             fail-fast: false
 
@@ -38,16 +38,16 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Set up Go ${{ matrix.go-version }}
-              uses: actions/setup-go@v6
+              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
               with:
                   go-version: ${{ matrix.go-version }}
                   cache: false
 
             - name: Cache Go modules
-              uses: actions/cache@v5
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       ~/go/pkg/mod
@@ -65,20 +65,20 @@ jobs:
               run: go mod download
 
             - name: Lint collector code
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: collector
               run: |
                   go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
                   echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
                   make lint
 
             - name: Run go vet
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: collector
               run: go vet ./...
 
             - name: Check formatting
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: collector
               run: |
                   gofmt -l ./src > /tmp/gofmt.out
@@ -111,22 +111,22 @@ jobs:
               run: make coverage
 
             - name: Generate coverage report
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: collector
               run: |
                   go tool cover -func=src/coverage.out
 
             - name: Upload build artifact
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
-              uses: actions/upload-artifact@v7
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: ai-dba-collector-linux-amd64
                   path: collector/ai-dba-collector
                   retention-days: 7
 
             - name: Upload coverage artifact
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
-              uses: actions/upload-artifact@v7
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: collector-coverage
                   path: |

.github/workflows/ci-docker.yml

@@ -39,10 +39,10 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
             - name: Create secret files
               run: |

.github/workflows/ci-docs.yml

@@ -28,10 +28,10 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Set up Python
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
               with:
                   python-version: '3.11'
                   cache: 'pip'
@@ -48,7 +48,7 @@ jobs:
                   mkdocs build -v
 
             - name: Upload documentation artifact
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   if-no-files-found: error
                   name: ai-workbench-docs-site

.github/workflows/ci-server.yml

@@ -18,7 +18,7 @@ jobs:
         runs-on: ubuntu-latest
         strategy:
             matrix:
-                go-version: ['1.26']
+                go-version: ['1.26.2']
                 postgres-version: ['14', '15', '16', '17', '18']
             fail-fast: false
 
@@ -38,16 +38,16 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Set up Go ${{ matrix.go-version }}
-              uses: actions/setup-go@v6
+              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
               with:
                   go-version: ${{ matrix.go-version }}
                   cache: false
 
             - name: Cache Go modules
-              uses: actions/cache@v5
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
               with:
                   path: |
                       ~/go/pkg/mod
@@ -65,20 +65,20 @@ jobs:
               run: go mod download
 
             - name: Lint server code
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: server
               run: |
                   go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
                   echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
                   make lint
 
             - name: Run go vet
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: server/src
               run: go vet ./...
 
             - name: Check formatting
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: server
               run: |
                   gofmt -l ./src > /tmp/gofmt.out
@@ -111,22 +111,22 @@ jobs:
               run: make coverage
 
             - name: Generate coverage report
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
               working-directory: server/src
               run: |
                   go tool cover -func=coverage.out
 
             - name: Upload build artifact
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
-              uses: actions/upload-artifact@v7
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: ai-dba-server-linux-amd64
                   path: server/ai-dba-server
                   retention-days: 7
 
             - name: Upload coverage artifact
-              if: matrix.go-version == '1.26' && matrix.postgres-version == '18'
-              uses: actions/upload-artifact@v7
+              if: matrix.go-version == '1.26.2' && matrix.postgres-version == '18'
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
               with:
                   name: server-coverage
                   path: |

.github/workflows/ci-walkthrough.yml

@@ -24,7 +24,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Validate Docker Compose
               run: docker compose -f examples/walkthrough/docker-compose.yml config --quiet
@@ -40,7 +40,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
             - name: Log in to GHCR
               uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3