From b53540d1f32eb0cbf1df53b9ab1a3394f56d8190 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 7 Oct 2026 17:55:03 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/ci.yml | 4 ++-- .github/workflows/official-build.yml | 4 ++-- .github/workflows/on-push-verification.yml | 6 +++--- .github/workflows/sample-workflow.yml | 8 ++++---- .github/workflows/self-hosted-validation-v1.yml | 4 ++-- .github/workflows/toolchain-version-probe.yml | 2 +- 7 files changed, 16 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4c158bd8..03a8e61f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,5 @@ updates: - "dependencies" commit-message: prefix: "fix(ci)" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d738944d..3b2e7a26 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,10 +14,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '24' diff --git a/.github/workflows/official-build.yml b/.github/workflows/official-build.yml index 99ce274d..33419a76 100644 --- a/.github/workflows/official-build.yml +++ b/.github/workflows/official-build.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Extract branch name shell: bash @@ -25,7 +25,7 @@ jobs: id: extract_branch - name: Set up Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '24' diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml index 4bd35a88..e4d325e2 100644 --- a/.github/workflows/on-push-verification.yml +++ b/.github/workflows/on-push-verification.yml @@ -22,7 +22,7 @@ jobs: steps: # Checkout your code repository to scan - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Run analyzers - uses: ./ @@ -30,13 +30,13 @@ jobs: # Upload alerts to the Security tab - name: Upload alerts to Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: ${{ steps.msdo.outputs.sarifFile }} # Upload alerts file as a workflow artifact - name: Upload alerts file as a workflow artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: alerts-${{ matrix.os }} path: ${{ steps.msdo.outputs.sarifFile }} diff --git a/.github/workflows/sample-workflow.yml b/.github/workflows/sample-workflow.yml index 77c6cf47..a5b9fec3 100644 --- a/.github/workflows/sample-workflow.yml +++ b/.github/workflows/sample-workflow.yml @@ -20,22 +20,22 @@ jobs: steps: # Checkout your code repository to scan - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Run analyzers - name: Run Microsoft Security DevOps Analysis - uses: microsoft/security-devops-action@v1 + uses: microsoft/security-devops-action@5b26a185ff02cf7c100778adeff0ebbf704ca144 # v1 id: msdo # Upload alerts to the Security tab - name: Upload alerts to Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: ${{ steps.msdo.outputs.sarifFile }} # Upload alerts file as a workflow artifact - name: Upload alerts file as a workflow artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: alerts-${{ matrix.os }} path: ${{ steps.msdo.outputs.sarifFile }} diff --git a/.github/workflows/self-hosted-validation-v1.yml b/.github/workflows/self-hosted-validation-v1.yml index 3471076b..a14be783 100644 --- a/.github/workflows/self-hosted-validation-v1.yml +++ b/.github/workflows/self-hosted-validation-v1.yml @@ -14,7 +14,7 @@ jobs: steps: # Checkout your code repository to scan - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Run MSDO v1 - name: Run MSDO @@ -23,7 +23,7 @@ jobs: # Upload results to the Security tab - name: Upload results to Security tab - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3.38.2 if: always() with: sarif_file: ${{ steps.msdo.outputs.sarifFile }} diff --git a/.github/workflows/toolchain-version-probe.yml b/.github/workflows/toolchain-version-probe.yml index ecc8c564..11455656 100644 --- a/.github/workflows/toolchain-version-probe.yml +++ b/.github/workflows/toolchain-version-probe.yml @@ -29,7 +29,7 @@ jobs: # Run MSDO — scan may find nothing (no real targets), that's fine. # Side effect: Guardian downloads all tool packages into _msdo/packages/nuget/. - name: Install MSDO tools - uses: microsoft/security-devops-action@main + uses: microsoft/security-devops-action@08976cb623803b1b36d7112d4ff9f59eae704de0 # v1.12.0 continue-on-error: true with: tools: bandit,binskim,checkov,eslint,templateanalyzer,terrascan,trivy