chore: pin some dependencies by hash

* Update `github-action-renovate-config-validator` action to specific commit hash
* Pin actions in `nightly-build.yml` by hash
* Specify `Miniconda` version and add checksum verification in `onedal-dev.Dockerfile`

.github/workflows/nightly-build.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout oneDAL
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           repository: oneapi-src/oneDAL
       - name: Install DPC++
@@ -51,7 +51,7 @@ jobs:
           source /opt/intel/oneapi/compiler/latest/env/vars.sh
           .ci/scripts/build.sh --compiler icx  --optimizations avx2 --target onedal
       - name: Archive build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         with:
           name: __release_lnx
           path: ./__release_lnx
@@ -64,7 +64,7 @@ jobs:
 
     steps:
       - name: Checkout oneDAL
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           repository: oneapi-src/oneDAL
       - name: Install DPC++
@@ -96,7 +96,7 @@ jobs:
           call .\dpcpp\compiler\latest\bin\sycl-ls.exe
           call .\.ci\scripts\build.bat onedal_dpc vc avx2
       - name: Archive build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         with:
           name: __release_win
           path: .\__release_win_vc
@@ -105,12 +105,12 @@ jobs:
         run: |
           tar -cvzf icx.zip .\dpcpp
       - name: Archive DPC++
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         with:
           name: icx_compiler
           path: .\icx.zip
       - name: Archive Intel OpenCL CPU runtime
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         with:
           name: opencl_rt_installer
           path: .\opencl_rt.msi

.github/workflows/renovate-validation.yml

@@ -25,6 +25,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Validate
-        uses: suzuki-shunsuke/github-action-renovate-config-validator@v1.1.0
+        uses: suzuki-shunsuke/github-action-renovate-config-validator@36a15b83e37bf3221dc9c02ff5ffdaefb51ca1cf # v1.1.0
         with:
           config_file_path: .github/renovate.json

dev/docker/onedal-dev.Dockerfile

@@ -17,6 +17,7 @@
 FROM ubuntu:22.04@sha256:adbb90115a21969d2fe6fa7f9af4253e16d45f8d4c1e930182610c4731962658
 
 ARG workdirectory="/sources/oneDAL"
+ARG miniconda_version="py312_24.5.0-0"
 
 COPY . ${workdirectory}
 
@@ -28,7 +29,9 @@ RUN apt-get update && \
 
 # Install miniconda
 ENV CONDA_DIR /opt/conda
-RUN wget --quiet https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh -O ~/miniconda.sh && \
+
+RUN wget --quiet https://repo.anaconda.com/miniconda/Miniconda3-${miniconda_version}-Linux-x86_64.sh -O ~/miniconda.sh && \
+    echo "4b3b3b1b99215e85fd73fb2c2d7ebf318ac942a457072de62d885056556eb83e" ~/miniconda.sh | sha256sum -c - && \
     /bin/bash ~/miniconda.sh -b -p /opt/conda
 
 # Put conda in path to use conda activate