Use a debian trixie base image

.config/ruff.toml

@@ -7,8 +7,8 @@ src = ["docs-gen", "image/src"]
 include = [
     "docs-gen/*.py",
     "image/src/*.py",
-    "image/src/setup.py",
-    "tools/*.py",
+    "image/setup.py",
+    "image/tools/*.py",
 ]
 
 [lint]

.github/workflows/base-image.yaml

@@ -4,11 +4,13 @@ on:
   push:
     branches:
       - main
+      - trixie
     paths:
       - image/Dockerfile-base
       - .github/workflows/base-image.yaml
   schedule:
     - cron: 0 1 1 * *
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -25,7 +27,7 @@ jobs:
       url: https://hub.docker.com/r/danielflook/terraform-github-actions-base/tags?name=${{ github.run_id }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -36,18 +38,18 @@ jobs:
           echo "$DOCKER_TOKEN" | docker login --username danielflook --password-stdin
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Base image
         id: build-and-push
         run: |
-          BASE_DIGEST=$(docker buildx imagetools inspect "debian:bookworm-slim" --format '{{json .}}' | jq -r '.manifest.digest')
+          BASE_DIGEST=$(docker buildx imagetools inspect "debian:trixie-slim" --format '{{json .}}' | jq -r '.manifest.digest')
 
-          sed -i "s|FROM debian:bookworm-slim|FROM debian:bookworm-slim@$BASE_DIGEST|" "image/Dockerfile-base"
+          sed -i "s|FROM debian:trixie-slim|FROM debian:trixie-slim@$BASE_DIGEST|" "image/Dockerfile-base"
 
           docker buildx build \
             --tag "danielflook/terraform-github-actions-base:$GITHUB_RUN_ID" \
-            --tag danielflook/terraform-github-actions-base:latest  \
+            --tag danielflook/terraform-github-actions-base:trixie  \
             --platform linux/amd64,linux/arm64 \
             --attest "type=provenance,mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
             --annotation "index,manifest:org.opencontainers.image.created=$(date '+%Y-%m-%dT%H:%M:%S%z')" \
@@ -58,7 +60,7 @@ jobs:
             --annotation "index:org.opencontainers.image.ref.name=docker.io/danielflook/terraform-github-actions-base:$GITHUB_RUN_ID" \
             --annotation "index,manifest:builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
             --annotation "index,manifest:ref.tag=$GITHUB_RUN_ID" \
-            --annotation "index,manifest:org.opencontainers.image.base.name=docker.io/debian:bookworm-slim" \
+            --annotation "index,manifest:org.opencontainers.image.base.name=docker.io/debian:trixie-slim" \
             --annotation "index,manifest:base.manifest.digest=$BASE_DIGEST" \
             --file image/Dockerfile-base \
             --push \
@@ -68,7 +70,7 @@ jobs:
           echo "digest=$(<manifest-list-digest.txt)" >> "$GITHUB_OUTPUT"
 
       - name: Generate image attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-name: index.docker.io/danielflook/terraform-github-actions-base
           subject-digest: ${{ steps.build-and-push.outputs.digest }}

.github/workflows/pull_request_review.yaml

@@ -17,7 +17,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/pull_request_target.yaml

@@ -29,13 +29,13 @@ jobs:
           EOF
 
       - name: Plan
-        uses: dflook/terraform-plan@v1
+        uses: dflook/terraform-plan@7878bff63e2099cdc9be9a6f33cbbbf687f8f0fe # v2.2.3
         with:
           label: pull_request_target
           path: test-module
 
       - name: Apply
-        uses: dflook/terraform-apply@v1
+        uses: dflook/terraform-apply@5489b988934a50bf1489d5b7c5253b46520a7dca # v2.2.3
         id: output
         with:
           label: pull_request_target

.github/workflows/release.yaml

@@ -25,7 +25,7 @@ jobs:
       base-digest: ${{ steps.image_build.outputs.base-digest }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -43,7 +43,7 @@ jobs:
           echo "$DOCKER_TOKEN" | docker login --username danielflook --password-stdin
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build action image
         id: image_build
@@ -85,13 +85,13 @@ jobs:
           echo "base-digest=$BASE_DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Dockerhub ref attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-name: index.docker.io/danielflook/terraform-github-actions
           subject-digest: ${{ steps.image_build.outputs.digest }}
 
       - name: GHCR ref attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-name: ghcr.io/dflook/terraform-github-actions
           subject-digest: ${{ steps.image_build.outputs.digest }}
@@ -106,7 +106,7 @@ jobs:
       url: https://github.com/dflook/terraform-github-actions/releases/tag/${{ github.event.release.tag_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -206,7 +206,7 @@ jobs:
           echo "$DOCKER_TOKEN" | docker login --username danielflook --password-stdin
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Tag and push base image with release version
         env:

.github/workflows/repository_dispatch.yaml

@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/retain-images.yaml

@@ -16,7 +16,7 @@ jobs:
     name: Pull images
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0