diff --git a/.github/workflows/_build_image.yml b/.github/workflows/_build_image.yml
index ebfa0ea22c..09c698a427 100644
--- a/.github/workflows/_build_image.yml
+++ b/.github/workflows/_build_image.yml
@@ -78,7 +78,7 @@ jobs:
           fi
 
       - name: Checkout out GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: ${{ env.CHECKOUT_REF }}
           fetch-depth: 0
diff --git a/.github/workflows/_get-image-list.yml b/.github/workflows/_get-image-list.yml
index 0061070762..7f8e785cc7 100644
--- a/.github/workflows/_get-image-list.yml
+++ b/.github/workflows/_get-image-list.yml
@@ -31,10 +31,10 @@ jobs:
       run_matrix: ${{ steps.get-matrix.outputs.run_matrix }}
     steps:
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Checkout GenAIComps Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           repository: opea-project/GenAIComps
           path: GenAIComps
@@ -45,7 +45,7 @@ jobs:
           image_list=[]
           run_matrix="{\"include\":["
           if [[ ! -z "${{ inputs.examples }}" ]]; then
-              pip install yq
+              pip install yq==3.4.3
               examples=($(echo ${{ inputs.examples }} | tr ',' ' '))
               for example in ${examples[@]}
               do
diff --git a/.github/workflows/_get-test-matrix.yml b/.github/workflows/_get-test-matrix.yml
index 6608884eae..f710564d2d 100644
--- a/.github/workflows/_get-test-matrix.yml
+++ b/.github/workflows/_get-test-matrix.yml
@@ -47,7 +47,7 @@ jobs:
           echo "checkout ref ${{ env.CHECKOUT_REF }}"
 
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: ${{ env.CHECKOUT_REF }}
           fetch-depth: 0
diff --git a/.github/workflows/_helm-e2e.yml b/.github/workflows/_helm-e2e.yml
index 3bc03826c5..f05f046cdc 100644
--- a/.github/workflows/_helm-e2e.yml
+++ b/.github/workflows/_helm-e2e.yml
@@ -55,7 +55,7 @@ jobs:
           echo "checkout ref ${CHECKOUT_REF}"
 
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: ${{ steps.get-checkout-ref.outputs.CHECKOUT_REF }}
           fetch-depth: 0
@@ -128,7 +128,7 @@ jobs:
           echo "checkout ref ${CHECKOUT_REF}"
 
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: ${{ steps.get-checkout-ref.outputs.CHECKOUT_REF }}
           fetch-depth: 0
diff --git a/.github/workflows/_run-docker-compose.yml b/.github/workflows/_run-docker-compose.yml
index 46dbed8b32..b8fb7ff6e4 100644
--- a/.github/workflows/_run-docker-compose.yml
+++ b/.github/workflows/_run-docker-compose.yml
@@ -61,7 +61,7 @@ jobs:
           echo "checkout ref ${CHECKOUT_REF}"
 
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: ${{ steps.get-checkout-ref.outputs.CHECKOUT_REF }}
           fetch-depth: 0
@@ -150,7 +150,7 @@ jobs:
           docker images
 
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: ${{ needs.get-test-case.outputs.CHECKOUT_REF }}
           fetch-depth: 0
@@ -243,7 +243,7 @@ jobs:
 
       - name: Publish pipeline artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: ${{ inputs.hardware }}_${{ inputs.example }}_${{ matrix.test_case }}
           path: ${{ github.workspace }}/${{ inputs.example }}/tests/*.log
diff --git a/.github/workflows/_run-one-click.yml b/.github/workflows/_run-one-click.yml
index 85c20bbca5..78527d5938 100644
--- a/.github/workflows/_run-one-click.yml
+++ b/.github/workflows/_run-one-click.yml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Checkout out Repo
         if: ${{ inputs.deploy_method == 'docker' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -94,7 +94,7 @@ jobs:
 
       - name: Checkout out Repo
         if: ${{ inputs.deploy_method == 'k8s' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -153,7 +153,7 @@ jobs:
           LVM_model: ${{ env.LVM_model }}
         run: |
           cd ${{ github.workspace }}/one_click_deploy
-          python3 -m pip install -r requirements.txt
+          python3 -m pip install --require-hashes -r requirements.txt
 
           if [ "${{ inputs.deploy_method }}" = "k8s" ]; then
             export OPEA_K8S_VLLM_SKIP_WARMUP=TRUE
@@ -205,7 +205,7 @@ jobs:
 
       - name: Publish pipeline artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: ${{ inputs.deploy_method }}
           path: ${{ github.workspace }}/${{ inputs.deploy_method }}-tests/test-results.log
diff --git a/.github/workflows/_trivy-scan.yml b/.github/workflows/_trivy-scan.yml
index 05dd74d4b8..c90d74350b 100644
--- a/.github/workflows/_trivy-scan.yml
+++ b/.github/workflows/_trivy-scan.yml
@@ -43,7 +43,7 @@ jobs:
           sudo rm -rf ${{github.workspace}}/* || true
           docker system prune -f
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       - name: Install Dependencies
         run: |
           sudo apt-get update
@@ -91,7 +91,7 @@ jobs:
         shell: bash
 
       - name: Security Scan Container
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
         if: ${{ inputs.trivy_scan }}
         with:
           image-ref: ${{ env.OPEA_IMAGE_REPO }}opea/${{ inputs.image }}:${{ inputs.tag }}
diff --git a/.github/workflows/check-online-doc-build.yml b/.github/workflows/check-online-doc-build.yml
index fecb227503..3a3db1c4c8 100644
--- a/.github/workflows/check-online-doc-build.yml
+++ b/.github/workflows/check-online-doc-build.yml
@@ -17,12 +17,12 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       with:
         path: GenAIExamples
 
     - name: Checkout docs
-      uses: actions/checkout@v4
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       with:
         repository: opea-project/docs
         path: docs
diff --git a/.github/workflows/daily-update-vllm-version.yml.disabled b/.github/workflows/daily-update-vllm-version.yml.disabled
index 0263c75239..ea579157e0 100644
--- a/.github/workflows/daily-update-vllm-version.yml.disabled
+++ b/.github/workflows/daily-update-vllm-version.yml.disabled
@@ -32,7 +32,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
           ref: ${{ github.ref }}
diff --git a/.github/workflows/docker/code-scan.dockerfile b/.github/workflows/docker/code-scan.dockerfile
index 73fad03a26..0a91d86320 100644
--- a/.github/workflows/docker/code-scan.dockerfile
+++ b/.github/workflows/docker/code-scan.dockerfile
@@ -1,8 +1,8 @@
 # Copyright (C) 2024 Intel Corporation
 # SPDX-License-Identifier: Apache-2.0
 
-ARG UBUNTU_VER=22.04
-FROM ubuntu:${UBUNTU_VER} as devel
+# ARG UBUNTU_VER=22.04
+FROM ubuntu@sha256:4e0171b9275e12d375863f2b3ae9ce00a4c53ddda176bd55868df97ac6f21a6e as devel
 
 ENV LANG=C.UTF-8
 
diff --git a/.github/workflows/dockerhub-description.yml b/.github/workflows/dockerhub-description.yml
index 296f464f47..a737eb5399 100644
--- a/.github/workflows/dockerhub-description.yml
+++ b/.github/workflows/dockerhub-description.yml
@@ -84,25 +84,25 @@ jobs:
       fail-fast: false
     steps:
     - name: Checkout GenAIExamples
-      uses: actions/checkout@v4
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       with:
         repository: opea-project/GenAIExamples
         path: GenAIExamples
 
     - name: Checkout GenAIComps
-      uses: actions/checkout@v4
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       with:
         repository: opea-project/GenAIComps
         path: GenAIComps
 
     - name: Checkout vllm-openvino
-      uses: actions/checkout@v4
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       with:
         repository: vllm-project/vllm
         path: vllm
 
     - name: Checkout vllm-gaudi
-      uses: actions/checkout@v4
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       with:
         repository: HabanaAI/vllm-fork
         ref: habana_main
diff --git a/.github/workflows/manual-docker-scan.yml b/.github/workflows/manual-docker-scan.yml
index 4aec879c02..b4c0e26988 100644
--- a/.github/workflows/manual-docker-scan.yml
+++ b/.github/workflows/manual-docker-scan.yml
@@ -59,7 +59,7 @@ jobs:
     runs-on: "docker-build-${{ inputs.node }}"
     if: always()
     steps:
-      - uses: actions/upload-artifact@v4.3.4
+      - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b
         with:
           name: trivy-scan-${{ inputs.tag }}-${{ github.run_number }}
           path: /tmp/scan-${{ inputs.tag }}-${{ github.run_number }}/*-trivy-scan.txt
diff --git a/.github/workflows/manual-freeze-tag.yml b/.github/workflows/manual-freeze-tag.yml
index 88c1bb6c85..476bb3f4b2 100644
--- a/.github/workflows/manual-freeze-tag.yml
+++ b/.github/workflows/manual-freeze-tag.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
           ref: ${{ github.ref }}
diff --git a/.github/workflows/mix-trellix.yml b/.github/workflows/mix-trellix.yml
index 65f18e6dbc..bad18fa631 100644
--- a/.github/workflows/mix-trellix.yml
+++ b/.github/workflows/mix-trellix.yml
@@ -17,7 +17,7 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Run Trellix Scanner
         env:
@@ -26,6 +26,6 @@ jobs:
 
       - name: Publish pipeline artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           path: ${{ github.workspace }}/.github/workflows/scripts/codeScan/report.html
diff --git a/.github/workflows/pr-chart-e2e.yml b/.github/workflows/pr-chart-e2e.yml
index 3990e5fce9..256151fb09 100644
--- a/.github/workflows/pr-chart-e2e.yml
+++ b/.github/workflows/pr-chart-e2e.yml
@@ -28,7 +28,7 @@ jobs:
       run_matrix: ${{ steps.get-test-matrix.outputs.run_matrix }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           ref: "refs/pull/${{ github.event.number }}/merge"
           fetch-depth: 0
diff --git a/.github/workflows/pr-check-duplicated-image.yml b/.github/workflows/pr-check-duplicated-image.yml
index 2922b8f4fe..8c39c64fd8 100644
--- a/.github/workflows/pr-check-duplicated-image.yml
+++ b/.github/workflows/pr-check-duplicated-image.yml
@@ -27,11 +27,11 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Check all the docker image build files
         run: |
-          pip install PyYAML
+          pip install PyYAML==6.0.3
           cd ${{github.workspace}}
           build_files=""
           for f in `find . -path "*/docker_image_build/build.yaml"`; do
diff --git a/.github/workflows/pr-code-scan.yml b/.github/workflows/pr-code-scan.yml
index f64184c519..839c196311 100644
--- a/.github/workflows/pr-code-scan.yml
+++ b/.github/workflows/pr-code-scan.yml
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Check Dangerous Command Injection
         uses: opea-project/validation/actions/check-cmd@main
@@ -62,7 +62,7 @@ jobs:
 
       - name: Publish pipeline artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: ${{ matrix.job_name }}
           path: ${{ github.workspace }}/.github/workflows/scripts/codeScan/${{ matrix.job_name }}.*
@@ -74,7 +74,7 @@ jobs:
       contents: read
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -98,7 +98,7 @@ jobs:
       - name: ShellCheck
         # if: ${{ env.changed_files != '' }}
         if: steps.get-changed-files.outputs.changed_files_exist == 'true'
-        uses: ludeeus/action-shellcheck@2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
         env:
           SHELLCHECK_OPTS: -e SC2164 -e SC2154 -e SC2034 -e SC2155 -e SC1090 -e SC2153 -e SC2046
         with:
diff --git a/.github/workflows/pr-dependency-review.yml b/.github/workflows/pr-dependency-review.yml
index 0867382269..01527452a8 100644
--- a/.github/workflows/pr-dependency-review.yml
+++ b/.github/workflows/pr-dependency-review.yml
@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
       - name: Dependency Review
         uses: actions/dependency-review-action@v4
         with:
diff --git a/.github/workflows/pr-dockerfile-path-and-build-yaml-scan.yml b/.github/workflows/pr-dockerfile-path-and-build-yaml-scan.yml
index 1894776d3f..7ecbd9ef09 100644
--- a/.github/workflows/pr-dockerfile-path-and-build-yaml-scan.yml
+++ b/.github/workflows/pr-dockerfile-path-and-build-yaml-scan.yml
@@ -17,7 +17,7 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout Repo GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Clone Repo GenAIComps
         run: |
@@ -50,7 +50,7 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout Repo GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -85,11 +85,11 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout Repo GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Check name agreement in build.yaml
         run: |
-          pip install ruamel.yaml
+          pip install ruamel.yaml==0.18.6
           cd ${{github.workspace}}
           consistency="TRUE"
           build_yamls=$(find . -name 'build.yaml')
diff --git a/.github/workflows/pr-image-size.yml b/.github/workflows/pr-image-size.yml
index cc2788776d..0274423875 100644
--- a/.github/workflows/pr-image-size.yml
+++ b/.github/workflows/pr-image-size.yml
@@ -23,7 +23,7 @@ jobs:
       files: ${{ steps.changed-dockerfiles.outputs.files }}
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -50,12 +50,12 @@ jobs:
       skip: ${{ steps.build-check.outputs.skip }}
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
 
       - name: Build and check image sizes
         id: build-check
@@ -128,7 +128,7 @@ jobs:
 
       - name: Download origin artifact log
         if: env.skip != 'true'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4
         with:
           name: build-comments
           path: merged-files
@@ -143,7 +143,7 @@ jobs:
 
       - name: Save Summary as Artifact
         if: env.skip != 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
         with:
           name: build-comments
           path: merged-files/
@@ -159,7 +159,7 @@ jobs:
       all_comments: ${{ steps.summary.outputs.all_comments }}
     steps:
       - name: Download Summary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4
         with:
           name: build-comments
           path: downloaded-files
diff --git a/.github/workflows/pr-link-path-scan.yml b/.github/workflows/pr-link-path-scan.yml
index 932646a52d..a14eaf3cd3 100644
--- a/.github/workflows/pr-link-path-scan.yml
+++ b/.github/workflows/pr-link-path-scan.yml
@@ -19,7 +19,7 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout Repo GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -84,7 +84,7 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout Repo GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/push-images-path-detection.yml b/.github/workflows/push-images-path-detection.yml
index 9edfad2678..7137cb225c 100644
--- a/.github/workflows/push-images-path-detection.yml
+++ b/.github/workflows/push-images-path-detection.yml
@@ -19,7 +19,7 @@ jobs:
         run: sudo rm -rf ${{github.workspace}}/*
 
       - name: Checkout repo GenAIExamples
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
 
       - name: Check the validity of links
         run: |
diff --git a/.github/workflows/push-infra-issue-creation.yml b/.github/workflows/push-infra-issue-creation.yml
index 3f8a22baf8..0175ff0e86 100644
--- a/.github/workflows/push-infra-issue-creation.yml
+++ b/.github/workflows/push-infra-issue-creation.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout out Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
@@ -42,7 +42,7 @@ jobs:
           echo "EOF" >> $GITHUB_ENV
 
       - name: Create Issue
-        uses: dacbd/create-issue-action@main
+        uses: dacbd/create-issue-action@fec641442c0897e734fad173cfe83ae21a2284a3
         with:
           token: ${{ secrets.ACTION_TOKEN }}
           owner: opea-project
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e6286dfa5d..b08b860059 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -76,6 +76,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/scripts/docker_compose_clean_up.sh b/.github/workflows/scripts/docker_compose_clean_up.sh
index f2789d7f5b..b83a8f0ca7 100644
--- a/.github/workflows/scripts/docker_compose_clean_up.sh
+++ b/.github/workflows/scripts/docker_compose_clean_up.sh
@@ -24,7 +24,7 @@ case "$1" in
         ;;
     ports)
         echo "Release all ports used by the services in $yaml_file ..."
-        pip install jq yq
+        pip install jq==1.10.0 yq==3.4.3
         ports=$(yq '.services[].ports[] | split(":")[0]' $yaml_file | grep -o '[0-9a-zA-Z_-]\+')
         echo "All ports list..."
         echo "$ports"
diff --git a/.github/workflows/weekly-one-click-test.yml b/.github/workflows/weekly-one-click-test.yml
index f0d04aa7fc..d60d7971e4 100644
--- a/.github/workflows/weekly-one-click-test.yml
+++ b/.github/workflows/weekly-one-click-test.yml
@@ -26,7 +26,7 @@ jobs:
       deploy_methods: ${{ steps.get-matrix.outputs.deploy_methods }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/weekly-update-images.yml b/.github/workflows/weekly-update-images.yml
index 9a8d1498a0..134476aeac 100644
--- a/.github/workflows/weekly-update-images.yml
+++ b/.github/workflows/weekly-update-images.yml
@@ -18,7 +18,7 @@ jobs:
       BRANCH_NAME: "update_images_tag"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
         with:
           fetch-depth: 0
           ref: "main"
diff --git a/AudioQnA/ui/docker/Dockerfile.openEuler b/AudioQnA/ui/docker/Dockerfile.openEuler
index 0a4d701592..7392bb62fd 100644
--- a/AudioQnA/ui/docker/Dockerfile.openEuler
+++ b/AudioQnA/ui/docker/Dockerfile.openEuler
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use node 20.11.1 as the base image
-FROM openeuler/node:20.11.1-oe2403lts
+FROM openeuler/node:20.11.1-oe2403lts@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd
 
 # Update package manager and install Git
 RUN yum update -y && \
@@ -18,7 +18,8 @@ COPY svelte /home/user/svelte
 WORKDIR /home/user/svelte
 
 # Install front-end dependencies
-RUN npm install
+RUN npm install --package-lock-only
+RUN npm ci
 
 # Build the front-end application
 RUN npm run build
diff --git a/ChatQnA/ui/docker/Dockerfile.openEuler b/ChatQnA/ui/docker/Dockerfile.openEuler
index cb594a33bb..b61654e440 100644
--- a/ChatQnA/ui/docker/Dockerfile.openEuler
+++ b/ChatQnA/ui/docker/Dockerfile.openEuler
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use node 20.11.1 as the base image
-FROM openeuler/node:20.11.1-oe2403lts
+FROM openeuler/node:20.11.1-oe2403lts@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd
 
 # Update package manager and install Git
 RUN yum update -y && \
diff --git a/ChatQnA/ui/docker/Dockerfile.react.openEuler b/ChatQnA/ui/docker/Dockerfile.react.openEuler
index edd8a21bca..3a89471fda 100644
--- a/ChatQnA/ui/docker/Dockerfile.react.openEuler
+++ b/ChatQnA/ui/docker/Dockerfile.react.openEuler
@@ -2,13 +2,13 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use node 20.11.1 as the base image
-FROM openeuler/node:20.11.1-oe2403lts as vite-app
+FROM openeuler/node:20.11.1-oe2403lts@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd as vite-app
  
 COPY react /usr/app/react
 WORKDIR /usr/app/react
 
-
-RUN ["npm", "install"]
+RUN ["npm", "install", "--package-lock-only"]
+RUN ["npm", "ci"]
 RUN ["npm", "run", "build"]
 
 
diff --git a/CodeGen/tests/test_ui_on_xeon.sh b/CodeGen/tests/test_ui_on_xeon.sh
index 18483d5071..e83b6c4079 100644
--- a/CodeGen/tests/test_ui_on_xeon.sh
+++ b/CodeGen/tests/test_ui_on_xeon.sh
@@ -45,9 +45,9 @@ function start_services() {
     docker compose -f ${compose_file} up -d > ${LOG_PATH}/start_services_with_compose.log
 
     n=0
-    until [[ "$n" -ge 100 ]]; do
+    until [[ "$n" -ge 200 ]]; do
         docker logs ${llm_container_name} > ${LOG_PATH}/llm_service_start.log 2>&1
-        if grep -E "Connected|complete" ${LOG_PATH}/llm_service_start.log; then
+        if grep -E "Connected|complete|healthy" ${LOG_PATH}/llm_service_start.log; then
             break
         fi
         sleep 5s
@@ -74,11 +74,43 @@ function validate_frontend() {
 
     export no_proxy="localhost,127.0.0.1,$ip_address"
 
+    # Wait for backend service to be ready
+    echo "Waiting for backend service to be ready..."
+    n=0
+    until [[ "$n" -ge 60 ]]; do
+        HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "http://${ip_address}:7778/v1/chatcompletions")
+        if [ "$HTTP_STATUS" = "200" ] || [ "$HTTP_STATUS" = "500" ]; then  # 500 might be expected if model is loading
+            echo "Backend service is ready"
+            break
+        fi
+        echo "Waiting for backend service... (attempt $n/60), HTTP status: $HTTP_STATUS"
+        sleep 5s
+        n=$((n+1))
+    done
+
+    # Wait for UI service to be ready
+    echo "Waiting for UI service to be ready..."
+    n=0
+    until [[ "$n" -ge 60 ]]; do
+        HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "http://${ip_address}:5173/health")
+        if [ "$HTTP_STATUS" = "200" ]; then
+            echo "UI service is ready"
+            break
+        fi
+        echo "Waiting for UI service... (attempt $n/60), HTTP status: $HTTP_STATUS"
+        sleep 5s
+        n=$((n+1))
+    done
+
+    # Run tests with better logging
+    echo "Starting Playwright tests..."
     exit_status=0
-    npx playwright test || exit_status=$?
+    npx playwright test --reporter=list > ${LOG_PATH}/frontend_test.log 2>&1 || exit_status=$?
 
     if [ $exit_status -ne 0 ]; then
         echo "[TEST INFO]: ---------frontend test failed---------"
+        echo "Test logs:"
+        cat ${LOG_PATH}/frontend_test.log
         exit $exit_status
     else
         echo "[TEST INFO]: ---------frontend test passed---------"
@@ -87,13 +119,13 @@ function validate_frontend() {
 
 function validate_gradio() {
     local URL="http://${ip_address}:5173/health"
-    local HTTP_STATUS=$(curl "$URL")
-    local SERVICE_NAME="Gradio"
+    local HTTP_STATUS=$(curl -s "$URL")
+    local SERVICE_NAME="CodeGen UI"
 
-    if [ "$HTTP_STATUS" = '{"status":"ok"}' ]; then
+    if [ "$HTTP_STATUS" = '{"status":"ok"}' ] || [ "$HTTP_STATUS" = "200" ]; then
         echo "[ $SERVICE_NAME ] HTTP status is 200. UI server is running successfully..."
     else
-        echo "[ $SERVICE_NAME ] UI server has failed..."
+        echo "[ $SERVICE_NAME ] UI server health check failed. Response: $HTTP_STATUS"
     fi
 }
 
@@ -138,6 +170,13 @@ function main() {
 
         echo "::group::validate_ui"
         validate_frontend
+        if [ $? -ne 0 ]; then
+            echo "Frontend validation failed, checking logs..."
+            if [ -f "${LOG_PATH}/frontend_test.log" ]; then
+                echo "Frontend test logs:"
+                cat "${LOG_PATH}/frontend_test.log"
+            fi
+        fi
         echo "::endgroup::"
 
         echo "::group::validate_gradio"
diff --git a/CodeGen/ui/docker/Dockerfile.gradio.openEuler b/CodeGen/ui/docker/Dockerfile.gradio.openEuler
index ce524ccbd7..a0605e33d2 100644
--- a/CodeGen/ui/docker/Dockerfile.gradio.openEuler
+++ b/CodeGen/ui/docker/Dockerfile.gradio.openEuler
@@ -1,7 +1,7 @@
 # Copyright (C) 2025 Huawei Technologies Co., Ltd.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM openeuler/python:3.11.13-oe2403lts
+FROM openeuler/python:3.11.13-oe2403lts@sha256:472759fb1852f35c9c0be20ff931aba6fbac1487175a0e46d6a73b6f6c33dd3c
 
 ENV LANG=C.UTF-8
 
diff --git a/CodeGen/ui/docker/Dockerfile.openEuler b/CodeGen/ui/docker/Dockerfile.openEuler
index 0a4d701592..efa2cf2723 100644
--- a/CodeGen/ui/docker/Dockerfile.openEuler
+++ b/CodeGen/ui/docker/Dockerfile.openEuler
@@ -2,7 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use node 20.11.1 as the base image
-FROM openeuler/node:20.11.1-oe2403lts
+
+FROM openeuler/node:20.11.1-oe2403lts@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd
 
 # Update package manager and install Git
 RUN yum update -y && \
@@ -18,7 +19,8 @@ COPY svelte /home/user/svelte
 WORKDIR /home/user/svelte
 
 # Install front-end dependencies
-RUN npm install
+RUN npm install --package-lock-only
+RUN npm ci
 
 # Build the front-end application
 RUN npm run build
diff --git a/CodeGen/ui/docker/Dockerfile.react.openEuler b/CodeGen/ui/docker/Dockerfile.react.openEuler
index 844b735cdc..9cba915a56 100644
--- a/CodeGen/ui/docker/Dockerfile.react.openEuler
+++ b/CodeGen/ui/docker/Dockerfile.react.openEuler
@@ -2,17 +2,17 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # Use node 20.11.1 as the base image
-FROM openeuler/node:20.11.1-oe2403lts as vite-app
+FROM openeuler/node@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd as vite-app
  
 COPY react /usr/app/react
 WORKDIR /usr/app/react
 
-
-RUN ["npm", "install"]
+RUN ["npm", "install", "--package-lock-only"]
+RUN ["npm", "ci"]
 RUN ["npm", "run", "build"]
 
 
-FROM openeuler/nginx:1.29.0-oe2403lts
+FROM openeuler/nginx:1.29.0-oe2403lts@sha256:80dcb7274946ef6c0c5c6ccaac5c81b8ac9c4c7c49f1f0bf61d4d9371b165b18
 
 COPY --from=vite-app /usr/app/react/dist /usr/share/nginx/html
 COPY ./react/env.sh /docker-entrypoint.d/env.sh
diff --git a/CodeGen/ui/svelte/tests/codeGen.spec.ts b/CodeGen/ui/svelte/tests/codeGen.spec.ts
index 751dd92b57..5c3de2789e 100644
--- a/CodeGen/ui/svelte/tests/codeGen.spec.ts
+++ b/CodeGen/ui/svelte/tests/codeGen.spec.ts
@@ -18,8 +18,12 @@ async function enterMessageToChat(page: Page, message: string) {
 	await page.getByTestId("code-input").click();
 	await page.getByTestId("code-input").fill(message);
 	await page.getByTestId("code-input").press("Enter");
-	await page.waitForTimeout(10000);
-	await expect(page.getByTestId("code-output")).toContainText("copy");
+
+	// Wait for the output container to appear first
+	await expect(page.getByTestId("code-output")).toBeVisible({ timeout: 30000 });
+
+	// Wait for content to be loaded and copy button to appear
+	await expect(page.getByTestId("code-output")).toContainText("copy", { timeout: 30000 });
 }
 
 // Test description: New Code Gen
diff --git a/one_click_deploy/requirements.txt b/one_click_deploy/requirements.txt
index ba5a359b99..91059047e5 100644
--- a/one_click_deploy/requirements.txt
+++ b/one_click_deploy/requirements.txt
@@ -1,4 +1,3 @@
 click
 requests
 ruamel.yaml
-