From deeb05a7ea7f94352cf481a552508a36e84e8603 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 11:52:06 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/codeql.yml | 8 ++++---- .../workflows/paportal-rolling-instance-actions.yml | 10 +++++----- .github/workflows/pull-request.yml | 8 ++++---- .github/workflows/rolling-instance-actions.yml | 4 ++-- 5 files changed, 24 insertions(+), 15 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0d7ccdc68..bdb5c770d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,3 +6,12 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cf1a7ad6a..7277c4ff4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,17 +37,17 @@ jobs: build-mode: none steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 with: languages: ${{ matrix.language }} config-file: ./.github/codeql/codeql-config.yml - name: Setup Node.js environment - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 24.x registry-url: https://npm.pkg.github.com @@ -64,6 +64,6 @@ jobs: AZ_DevOps_Read_PAT: ${{ secrets.AZ_DevOps_Read_PAT }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/paportal-rolling-instance-actions.yml b/.github/workflows/paportal-rolling-instance-actions.yml index 94e5fe41c..f56b8b350 100644 --- a/.github/workflows/paportal-rolling-instance-actions.yml +++ b/.github/workflows/paportal-rolling-instance-actions.yml @@ -33,12 +33,12 @@ jobs: PORTAL_MANIFEST_FILE_PATH: ./starter-portal/.portalconfig/*-manifest.yml steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: lfs: true - name: Setup Node.js environment - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 24.x registry-url: https://npm.pkg.github.com @@ -104,7 +104,7 @@ jobs: - name: Upload pac CLI logs if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: pac-cli-log ${{ matrix.os }} path: ./dist/pac*/tools/logs/pac-log.txt @@ -125,7 +125,7 @@ jobs: PORTAL_MANIFEST_FILE_PATH: ./starter-portal/.portalconfig/*-manifest.yml steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: lfs: true @@ -164,7 +164,7 @@ jobs: - name: Upload pac CLI logs if: always() - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1 with: name: pac-cli-log ${{ matrix.os }} path: ./dist/pac*/tools/logs/pac-log.txt diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 94c134065..bafaf862c 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -21,12 +21,12 @@ jobs: WF_APP_USER_ID: "9221a039-7e8f-4495-bb45-c97640522bad" steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: lfs: true - name: Setup Node.js environment - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 24.x registry-url: https://npm.pkg.github.com @@ -162,14 +162,14 @@ jobs: - name: Upload pac CLI logs if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: pac-cli-log ${{ matrix.os }} path: ./dist/pac*/tools/logs/pac-log.txt - name: Upload test logs if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: Test Logs ${{ matrix.os }} path: ./out/logs/*-tests.log diff --git a/.github/workflows/rolling-instance-actions.yml b/.github/workflows/rolling-instance-actions.yml index 7942281a8..1a38b0573 100644 --- a/.github/workflows/rolling-instance-actions.yml +++ b/.github/workflows/rolling-instance-actions.yml @@ -32,7 +32,7 @@ jobs: WF_APP_USER_ID: "9221a039-7e8f-4495-bb45-c97640522bad" steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: lfs: true @@ -281,7 +281,7 @@ jobs: - name: Upload pac CLI logs if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: pac-cli-log ${{ matrix.os }} path: ./dist/pac*/tools/logs/pac-log.txt