From bf468ae2c52ad5a10594a88a6da52a1ddf9bfcae Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 21 Aug 2026 14:46:07 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/pr-compliance-check.yml | 8 ++++---- 2 files changed, 15 insertions(+), 4 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/pr-compliance-check.yml b/.github/workflows/pr-compliance-check.yml index 64b1733b6..1c011397d 100644 --- a/.github/workflows/pr-compliance-check.yml +++ b/.github/workflows/pr-compliance-check.yml @@ -18,13 +18,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5 with: write_output_files: true separator: "\n" @@ -35,7 +35,7 @@ jobs: 04-Microsoft-365/** - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11' @@ -126,7 +126,7 @@ jobs: - name: Post comment on PR if: steps.final-status.outputs.COMPLIANCE_FAILED == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const fs = require('fs');