From 61f6b36fdb918107ee7f1acbc952e0e43fb643ce Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 18:46:50 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/actions/env-setup/action.yml | 4 ++-- .github/dependabot.yml | 11 +++++++++++ .github/workflows/AddIssueComment.yml | 2 +- .github/workflows/AddIssueCommentWithLabel.yml | 4 ++-- .github/workflows/AzdevLinter.yml | 2 +- .github/workflows/AzdevStyle.yml | 2 +- .github/workflows/BlockPRMerge.yml | 2 +- .github/workflows/CCOA.yml | 2 +- .github/workflows/GitHookNotice.yml | 2 +- .github/workflows/RunIssueSentinel.yml | 2 +- .github/workflows/TriggerReferenceDocsCI.yml | 2 +- 11 files changed, 23 insertions(+), 12 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actions/env-setup/action.yml b/.github/actions/env-setup/action.yml index 19d40dd7084..b5953254f8e 100644 --- a/.github/actions/env-setup/action.yml +++ b/.github/actions/env-setup/action.yml @@ -12,13 +12,13 @@ runs: run: | echo start azdev env setup - name: Checkout CLI repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 # checkout all branches ref: ${{ github.event.pull_request.head.ref }} repository: ${{ github.event.pull_request.head.repo.full_name }} # checkout pull request branch - name: Set up Python 3.12 - uses: actions/setup-python@v3 + uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4 with: python-version: "3.12" - name: Install azdev diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000000..2c48305b7eb --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/AddIssueComment.yml b/.github/workflows/AddIssueComment.yml index d8707a1febb..b4e53f09871 100644 --- a/.github/workflows/AddIssueComment.yml +++ b/.github/workflows/AddIssueComment.yml @@ -10,7 +10,7 @@ jobs: name: Say thanks for the Issue steps: - name: comment on the issue - uses: hasura/comment-progress@v2.3.0 + uses: hasura/comment-progress@146c635f3e325d478025e29e5043ec1c07c0e36c # v2.3.0 with: github-token: ${{ secrets.CLI_BOT }} repository: 'Azure/azure-cli' diff --git a/.github/workflows/AddIssueCommentWithLabel.yml b/.github/workflows/AddIssueCommentWithLabel.yml index d698e5ad9a8..ce265852ff5 100644 --- a/.github/workflows/AddIssueCommentWithLabel.yml +++ b/.github/workflows/AddIssueCommentWithLabel.yml @@ -12,12 +12,12 @@ jobs: name: Comment on issue steps: - name: Checkout comment message - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: sparse-checkout: | .github/template/non-security-comment.md - name: Comment on issue with no security label - uses: mshick/add-pr-comment@v2 + uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2 with: repo-token: ${{ secrets.GITHUB_TOKEN }} message-id: issueNoSecurityCommentBot diff --git a/.github/workflows/AzdevLinter.yml b/.github/workflows/AzdevLinter.yml index 73983edd739..175fdf01541 100644 --- a/.github/workflows/AzdevLinter.yml +++ b/.github/workflows/AzdevLinter.yml @@ -15,7 +15,7 @@ jobs: contents: read steps: - name: Checkout CLI repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 1 sparse-checkout: | diff --git a/.github/workflows/AzdevStyle.yml b/.github/workflows/AzdevStyle.yml index c2c40115317..6db750cd997 100644 --- a/.github/workflows/AzdevStyle.yml +++ b/.github/workflows/AzdevStyle.yml @@ -15,7 +15,7 @@ jobs: contents: read steps: - name: Checkout CLI repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 1 sparse-checkout: | diff --git a/.github/workflows/BlockPRMerge.yml b/.github/workflows/BlockPRMerge.yml index f108496c252..912b8506483 100644 --- a/.github/workflows/BlockPRMerge.yml +++ b/.github/workflows/BlockPRMerge.yml @@ -15,7 +15,7 @@ jobs: permissions: {} steps: - name: Check blocked labels - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const labels = context.payload.pull_request.labels.map(label => label.name); diff --git a/.github/workflows/CCOA.yml b/.github/workflows/CCOA.yml index 79d66238343..ba2393fe45a 100644 --- a/.github/workflows/CCOA.yml +++ b/.github/workflows/CCOA.yml @@ -36,7 +36,7 @@ jobs: - name: Comment on PR if: steps.date_check.outputs.continue == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/GitHookNotice.yml b/.github/workflows/GitHookNotice.yml index 1f2a569db85..adff1d9fb69 100644 --- a/.github/workflows/GitHookNotice.yml +++ b/.github/workflows/GitHookNotice.yml @@ -15,7 +15,7 @@ jobs: name: Introduce git hook in developer env steps: - name: Checkout git hook notice message - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: sparse-checkout: | .github/template/git-hooks-note.md diff --git a/.github/workflows/RunIssueSentinel.yml b/.github/workflows/RunIssueSentinel.yml index 6d0d2ccffcd..63a903b952b 100644 --- a/.github/workflows/RunIssueSentinel.yml +++ b/.github/workflows/RunIssueSentinel.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run Issue Sentinel - uses: Azure/issue-sentinel@v1 + uses: Azure/issue-sentinel@d1e433f192aa9442d44292b9b6d5d31419639aba # v1.6.1 with: enable-similar-issues-scanning: true enable-security-issues-scanning: true diff --git a/.github/workflows/TriggerReferenceDocsCI.yml b/.github/workflows/TriggerReferenceDocsCI.yml index 9c52c6390f5..8c0e35637bb 100644 --- a/.github/workflows/TriggerReferenceDocsCI.yml +++ b/.github/workflows/TriggerReferenceDocsCI.yml @@ -14,7 +14,7 @@ jobs: environment: docs steps: - name: Azure Login - uses: Azure/login@v2.1.0 + uses: Azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0 with: client-id: ${{ secrets.ADO_DocsReference_SP_ClientID }} tenant-id: ${{ secrets.ADO_DocsReference_SP_TenantID }}