From d4eff6466e43d0b5eb9c80567dfc7b7c37707c92 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 5 Sep 2026 21:51:23 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/cleanup-tools.yaml | 4 ++-- .github/workflows/compare-release-notes.yml | 4 ++-- .github/workflows/labeler.yaml | 2 +- .github/workflows/main.yaml | 4 ++-- .github/workflows/webplat-relnotes.yaml | 4 ++-- 6 files changed, 20 insertions(+), 9 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..2c48305b7e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/cleanup-tools.yaml b/.github/workflows/cleanup-tools.yaml index 0d816b9784..ead7f9c629 100644 --- a/.github/workflows/cleanup-tools.yaml +++ b/.github/workflows/cleanup-tools.yaml @@ -14,7 +14,7 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f + - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 # Call clean repo - name: Clean repo @@ -39,7 +39,7 @@ jobs: # Create the PR for the work done by the "clean repo" tool - name: create-pull-request - uses: peter-evans/create-pull-request@38e0b6e68b4c852a5500a94740f0e535e0d7ba54 + uses: peter-evans/create-pull-request@38e0b6e68b4c852a5500a94740f0e535e0d7ba54 # v4.2.4 with: branch: bot/cleanrepo-pull-request title: "Monthly chores: Automated repo cleanup" diff --git a/.github/workflows/compare-release-notes.yml b/.github/workflows/compare-release-notes.yml index 554b68f095..142e935ecb 100644 --- a/.github/workflows/compare-release-notes.yml +++ b/.github/workflows/compare-release-notes.yml @@ -13,9 +13,9 @@ jobs: issues: write models: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml index fa822f8a3d..6dfdbee2a4 100644 --- a/.github/workflows/labeler.yaml +++ b/.github/workflows/labeler.yaml @@ -11,7 +11,7 @@ jobs: triage: runs-on: ubuntu-latest steps: - - uses: github/issue-labeler@v3.1 + - uses: github/issue-labeler@e24a3eb6b2e28c8904d086302a2b760647f5f45c # v3.1 with: configuration-path: .github/labeler.yml enable-versioned-regex: 0 diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 8c82536062..618dda3a12 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -17,9 +17,9 @@ jobs: issues: write steps: - name: Checkout repo - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' - name: Install dependencies diff --git a/.github/workflows/webplat-relnotes.yaml b/.github/workflows/webplat-relnotes.yaml index 4e47e014a3..a27f2a5822 100644 --- a/.github/workflows/webplat-relnotes.yaml +++ b/.github/workflows/webplat-relnotes.yaml @@ -19,10 +19,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20'