chore: pin some dependencies by hash

* Update `github-action-renovate-config-validator` action to specific commit hash
* Pin actions in `nightly-build.yml` by hash
* Specify `Miniconda` version and add checksum verification in `onedal-dev.Dockerfile`

.github/workflows/nightly-build.yml

@@ -33,7 +33,7 @@ jobs:
 
  steps:
  - name: Checkout oneDAL
- uses: actions/checkout@v4
+ uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
  with:
  repository: oneapi-src/oneDAL
  - name: Install DPC++
@@ -51,7 +51,7 @@ jobs:
  source /opt/intel/oneapi/compiler/latest/env/vars.sh
  .ci/scripts/build.sh --compiler icx --optimizations avx2 --target onedal
  - name: Archive build
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
  with:
  name: __release_lnx
  path: ./__release_lnx
@@ -64,7 +64,7 @@ jobs:
 
  steps:
  - name: Checkout oneDAL
- uses: actions/checkout@v4
+ uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
  with:
  repository: oneapi-src/oneDAL
  - name: Install DPC++
@@ -96,7 +96,7 @@ jobs:
  call .\dpcpp\compiler\latest\bin\sycl-ls.exe
  call .\.ci\scripts\build.bat onedal_dpc vc avx2
  - name: Archive build
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
  with:
  name: __release_win
  path: .\__release_win_vc
@@ -105,12 +105,12 @@ jobs:
  run: |
  tar -cvzf icx.zip .\dpcpp
  - name: Archive DPC++
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
  with:
  name: icx_compiler
  path: .\icx.zip
  - name: Archive Intel OpenCL CPU runtime
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
  with:
  name: opencl_rt_installer
  path: .\opencl_rt.msi

.github/workflows/renovate-validation.yml

@@ -25,6 +25,6 @@ jobs:
  - name: Checkout
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
  - name: Validate
- uses: suzuki-shunsuke/github-action-renovate-config-validator@v1.1.0
+ uses: suzuki-shunsuke/github-action-renovate-config-validator@36a15b83e37bf3221dc9c02ff5ffdaefb51ca1cf # v1.1.0
  with:
  config_file_path: .github/renovate.json

dev/docker/onedal-dev.Dockerfile

@@ -17,6 +17,7 @@
 FROM ubuntu:22.04@sha256:adbb90115a21969d2fe6fa7f9af4253e16d45f8d4c1e930182610c4731962658
 
 ARG workdirectory="/sources/oneDAL"
+ARG miniconda_version="py312_24.5.0-0"
 
 COPY . ${workdirectory}
 
@@ -28,7 +29,9 @@ RUN apt-get update && \
 
 # Install miniconda
 ENV CONDA_DIR /opt/conda
-RUN wget --quiet https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh -O ~/miniconda.sh && \
+
+RUN wget --quiet https://repo.anaconda.com/miniconda/Miniconda3-${miniconda_version}-Linux-x86_64.sh -O ~/miniconda.sh && \
+ echo "4b3b3b1b99215e85fd73fb2c2d7ebf318ac942a457072de62d885056556eb83e" ~/miniconda.sh | sha256sum -c - && \
  /bin/bash ~/miniconda.sh -b -p /opt/conda
 
 # Put conda in path to use conda activate