chore(deps): pin dependencies (#3867)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| alpine | stage | pinDigest |  -> `21dc606` |
| docker.redpanda.com/redpandadata/console | | pinDigest | -> `0705aed`
|
| docker.redpanda.com/redpandadata/redpanda | | pinDigest | -> `46ed814`
|
| ftl0/ftl-runner | final | pinDigest |  -> `2e1f379` |
| grafana/otel-lgtm |  | pinDigest |  -> `a478671` |
| localstack/localstack |  | pinDigest |  -> `9d13ded` |
| mysql |  | pinDigest |  -> `106d519` |
| postgres |  | pinDigest |  -> `06dd85a` |
| [registry](https://redirect.github.com/distribution/distribution) | |
pinDigest | -> `543dade` |
| ubuntu | stage | pinDigest |  -> `80dd3c3` |
| ubuntu | final | pinDigest |  -> `80dd3c3` |

---

### Configuration

📅 **Schedule**: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/block/ftl).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS44NS4wIiwidXBkYXRlZEluVmVyIjoiMzkuODUuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicnVuLWFsbCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Dockerfile

@@ -2,7 +2,7 @@
 ARG RUNTIME=scratch-runtime
 
 # Get certificates from Alpine (smaller than Ubuntu)
-FROM alpine:latest AS certs
+FROM alpine:latest@sha256:21dc6063fd678b478f57c0e13f47560d0ea4eeba26dfc947b2a4f81f686b9f45 AS certs
 # No need to update here, we just use this for the certs
 RUN apk add ca-certificates
 
@@ -11,7 +11,7 @@ FROM scratch AS scratch-runtime
 COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 
 # Used for ftl-runner
-FROM ubuntu:24.04 AS ubuntu-runtime
+FROM ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab AS ubuntu-runtime
 RUN apt-get update && apt-get install -y ca-certificates
 RUN mkdir -p /root/deployments
 

Dockerfile.runner-jvm

@@ -1,4 +1,4 @@
-FROM ubuntu:24.04 AS builder
+FROM ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab AS builder
 RUN apt-get update
 RUN apt-get install -y curl git zip
 
@@ -10,7 +10,7 @@ RUN hermit install openjdk-21.0.3_9
 RUN mvn -B --version
 
 # Finally create the runtime image.
-FROM ftl0/ftl-runner:latest
+FROM ftl0/ftl-runner:latest@sha256:2e1f3791d65051c6936a95ef364a1c321990aeedf366864776b948a48c2c0430
 
 WORKDIR /root/
 

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   localstack:
-    image: localstack/localstack
+    image: localstack/localstack@sha256:9d13dedeb91c7e5e9e0cf62f5c2407d7b19a5bf7ffc3ef1efade1cb5f90db600
     profiles:
       - infra
     ports:

internal/dev/docker-compose.grafana.yml

@@ -1,6 +1,6 @@
 services:
   otel-lgtm:
-    image: ${FTL_GRAFANA_IMAGE:-grafana/otel-lgtm}
+    image: ${FTL_GRAFANA_IMAGE:-grafana/otel-lgtm@sha256:a4786717c4b29705e6464e2e82196fcb925de3c7f1970e923d8becac4ffd0c2a}
     ports:
       - 3000:3000 # Portal Endpoint
       - 9090:9090 # Prometheus

internal/dev/docker-compose.mysql.yml

@@ -1,6 +1,6 @@
 services:
   mysql:
-    image: mysql:8.4.3
+    image: mysql:8.4.3@sha256:106d5197fd8e4892980469ad42eb20f7a336bd81509aae4ee175d852f5cc4565
     environment:
       MYSQL_ROOT_PASSWORD: secret
       MYSQL_USER: mysql

internal/dev/docker-compose.postgres.yml

@@ -1,6 +1,6 @@
 services:
   db:
-    image: ${FTL_DATABASE_IMAGE:-postgres:15.10}
+    image: ${FTL_DATABASE_IMAGE:-postgres:15.10@sha256:06dd85a64e950719a3ee8435ce1bdc32b5f8acf406185d7ff875bcced5817165}
     command: postgres
     user: postgres
     # For local debugging

internal/dev/docker-compose.redpanda.yml

@@ -27,7 +27,7 @@ services:
       # Tells Seastar (the framework Redpanda uses under the hood) to use 1 core on the system.
       - --smp 1
       - --default-log-level=info
-    image: docker.redpanda.com/redpandadata/redpanda:v24.3.2
+    image: docker.redpanda.com/redpandadata/redpanda:v24.3.2@sha256:46ed8144e64aae1991cf439f96a05196425997a77abdf21941f0ff44ef7c5be0
     # container_name: redpanda-0
     volumes:
       - redpanda:/var/lib/redpanda/data
@@ -46,7 +46,7 @@ services:
       start_period: 80s
   redpanda-console:
     # container_name: redpanda-console
-    image: docker.redpanda.com/redpandadata/console:v2.8.1
+    image: docker.redpanda.com/redpandadata/console:v2.8.1@sha256:0705aeddb466f02315d250e719488f6c9286de0ca5a8677ebc81801afb9d52a7
     networks:
       - redpanda_network
     entrypoint: /bin/sh

internal/dev/docker-compose.registry.yml

@@ -1,5 +1,5 @@
 services:
   registry:
-    image: ${FTL_REGISTRY_IMAGE:-registry:2}
+    image: ${FTL_REGISTRY_IMAGE:-registry:2@sha256:543dade69668e02e5768d7ea2b0aa4fae6aa7384c9a5a8dbecc2be5136079ddb}
     ports:
       -  "${FTL_REGISTRY_PORT:-15000}:5000"