From a2023abb8b9ca2d1fb902b85e2ce78476f27986f Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 16 Sep 2026 10:38:30 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/auto-merge-dependabot.yml | 2 +- .github/workflows/php.yml | 8 ++++---- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0373519..02db514 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,3 +14,12 @@ updates: directory: "/app-auth/graphapponlytutorial" # Location of package manifests schedule: interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index cffb95a..9d839ef 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v1.1.1 + uses: dependabot/fetch-metadata@a3e5f86ae9f2f49b441498973ddec20035d326b8 # v1.1.1 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml index 2b12ea6..8a4c8b0 100644 --- a/.github/workflows/php.yml +++ b/.github/workflows/php.yml @@ -18,14 +18,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Validate composer.json and composer.lock run: composer validate --strict - name: Cache Composer packages id: composer-cache - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 with: path: vendor key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }} @@ -46,14 +46,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Validate composer.json and composer.lock run: composer validate --strict - name: Cache Composer packages id: composer-cache - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 with: path: vendor key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}