Pin GitHub Actions to commit SHAs

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/end-to-end.yml

@@ -14,13 +14,13 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out test fixture
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: 3ff4cb51f2cedc0a6415b31966353dd352d0d426
           fetch-depth: 0
 
       - name: Check out action under test
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           path: _action
           ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
       pull-requests: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -62,7 +62,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ steps.version.outputs.next }}
           name: ${{ steps.version.outputs.next }}

.github/workflows/test-cli-generic.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout cli/cli
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: cli/cli
           ref: ${{ inputs.head-ref }}

.github/workflows/test-cli.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout cli/cli
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: cli/cli
           ref: ${{ inputs.head-ref }}
@@ -32,7 +32,7 @@ jobs:
         run: git fetch origin ${{ inputs.base-ref }}
 
       - name: Checkout instructions file
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: github/copilot-release-notes
           path: _action-config

.github/workflows/test-custom.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout desktop/desktop
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: desktop/desktop
           ref: ${{ inputs.head-ref }}
@@ -32,7 +32,7 @@ jobs:
         run: git fetch origin ${{ inputs.base-ref }}
 
       - name: Checkout instructions file
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: github/copilot-release-notes
           path: _action-config

.github/workflows/test.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout desktop/desktop
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: desktop/desktop
           ref: ${{ inputs.head-ref }}