chore(build): pin pip and CI tool installs for Scorecard

.github/workflows/dep-audit.yml

@@ -120,7 +120,8 @@ jobs:
       - name: Install govulncheck
         shell: bash
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          # Bump tag when a new govulncheck release ships (Scorecard accepts semver tags for `go install`).
+          go install golang.org/x/vuln/cmd/govulncheck@v1.3.0
           echo "$HOME/go/bin" >> "$GITHUB_PATH"
 
       - name: Run govulncheck on every Go module

.github/workflows/docs-automation.yml

@@ -106,7 +106,7 @@ jobs:
           node-version: '24'
 
       - name: Install markdown-link-check
-        run: npm install -g markdown-link-check
+        run: npm install -g markdown-link-check@3.14.2
 
       - name: Check links in documentation
         continue-on-error: true

src/500-application/502-rust-http-connector/services/sensor-simulator/Dockerfile

@@ -27,8 +27,10 @@ WORKDIR /app
 
 # Install Python dependencies from pre-built wheels
 COPY --from=builder /wheels /wheels
-RUN pip install --no-cache-dir --no-index --find-links=/wheels/ Flask \
-    && rm -rf /wheels
+COPY --from=builder /app/requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir --no-index --require-hashes \
+      --find-links=/wheels/ -r /tmp/requirements.txt \
+    && rm -rf /wheels /tmp/requirements.txt
 
 # Copy application source code
 COPY src/ .

src/500-application/505-akri-rest-http-connector/services/sensor-simulator/Dockerfile

@@ -33,7 +33,8 @@ RUN tdnf install -y \
 # Install Python dependencies from pre-built wheels
 COPY --from=builder /tmp/wheels /wheels
 COPY --from=builder /build/requirements.txt /tmp/requirements.txt
-RUN pip install --no-cache-dir --no-index --find-links=/wheels -r /tmp/requirements.txt \
+RUN pip install --no-cache-dir --no-index --require-hashes \
+      --find-links=/wheels -r /tmp/requirements.txt \
     && rm -rf /wheels /tmp/requirements.txt
 
 # Copy application source and default configuration

src/500-application/506-ros2-connector/services/ros2-connector/Dockerfile

@@ -38,13 +38,15 @@ RUN set -euo pipefail \
         ros-jazzy-rmw-cyclonedds-cpp \
         ros-jazzy-rosidl-default-generators \
         ros-jazzy-ament-cmake \
-    && rm -rf /var/lib/apt/lists/* \
-    && pip3 install --break-system-packages --ignore-installed --no-cache-dir colcon-common-extensions==0.3.0
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /workspace
+COPY services/ros2-connector/requirements.colcon.txt /tmp/requirements.colcon.txt
 COPY resources/ros-interfaces/edge-ros-interface/ /workspace/edge-ros-interface/
 # hadolint ignore=SC1091 (ROS setup script provided by base image)
-RUN source /opt/ros/jazzy/setup.bash && colcon build --packages-select edge_ros_interface
+RUN pip3 install --break-system-packages --ignore-installed --no-cache-dir \
+        --require-hashes -r /tmp/requirements.colcon.txt \
+    && source /opt/ros/jazzy/setup.bash && colcon build --packages-select edge_ros_interface
 
 # Stage 2: Runtime - minimal runtime + built interfaces
 FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04@sha256:ad92cae7c25cafb1e7bb5aa7520b81be85fac022ea92e404b94a11127631fae3 AS runtime

src/500-application/506-ros2-connector/services/ros2-connector/requirements.colcon.in

@@ -0,0 +1 @@
+colcon-common-extensions==0.3.0

src/500-application/506-ros2-connector/services/ros2-simulator/Dockerfile

@@ -39,9 +39,11 @@ RUN apt-get update \
     ros-jazzy-ament-cmake \
   && rm -rf /var/lib/apt/lists/*
 WORKDIR /workspace
+COPY services/ros2-simulator/requirements.colcon.txt /tmp/requirements.colcon.txt
 COPY resources/ros-interfaces/edge-ros-interface/ /workspace/edge-ros-interface/
 # hadolint ignore=SC1091 (ROS setup script provided by base image)
-RUN pip3 install --break-system-packages --ignore-installed --no-cache-dir colcon-common-extensions==0.3.0 \
+RUN pip3 install --break-system-packages --ignore-installed --no-cache-dir \
+      --require-hashes -r /tmp/requirements.colcon.txt \
   && source /opt/ros/jazzy/setup.bash && colcon build --packages-select edge_ros_interface
 
 # Stage 2: Runtime (minimal + bag storage plugin + interfaces)

src/500-application/506-ros2-connector/services/ros2-simulator/requirements.colcon.in

@@ -0,0 +1 @@
+colcon-common-extensions==0.3.0