From b4e98d9f8ee18f8a51b093487cdc8b950537f5f1 Mon Sep 17 00:00:00 2001
From: Jason Johnston <jasonjoh@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:56:57 -0400
Subject: [PATCH] Pinned actions to specific commit SHAs

---
 .github/dependabot.yml                      | 6 ++++++
 .github/workflows/auto-merge-dependabot.yml | 8 ++++----
 .github/workflows/nodejs.yml                | 8 ++++----
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0aa3cff9..903cd07d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,3 +18,9 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
index cffb95aa..1f8110d0 100644
--- a/.github/workflows/auto-merge-dependabot.yml
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -3,7 +3,7 @@ name: Auto-merge dependabot updates
 on:
   pull_request:
     branches: [ main ]
-    
+
 permissions:
   pull-requests: write
   contents: write
@@ -13,16 +13,16 @@ jobs:
   dependabot-merge:
 
     runs-on: ubuntu-latest
-    
+
     if: ${{ github.actor == 'dependabot[bot]' }}
 
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.1.1
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
-      
+
       - name: Enable auto-merge for Dependabot PRs
         if: ${{steps.metadata.outputs.update-type != 'version-update:semver-major'}}
         run: gh pr merge --auto --merge "$PR_URL"
diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 7d1db22b..3af7dfa5 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -20,12 +20,12 @@ jobs:
         node-version: [ 22.x, 24.x ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Copy settings file
       run: |
         cp appSettings.example.ts appSettings.ts
     - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
     - name: Install dependencies
@@ -47,12 +47,12 @@ jobs:
         node-version: [ 22.x, 24.x ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Copy settings file
       run: |
         cp appSettings.example.ts appSettings.ts
     - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
     - name: Install dependencies