From 7a61a95d0bfc2b5317be19e358b849036f1dc11c Mon Sep 17 00:00:00 2001
From: mokhalil-dev <348820366+mokhalil-dev@users.noreply.github.com>
Date: Thu, 5 Nov 2026 19:51:42 +0000
Subject: [PATCH] ENG-1215: Update GitHub and SBOM Actions a to latest versions
 and pin to commit SHAs

At the time of writing, bump outdated GitHub Actions to their latest
released versions and pin each action to a full commit SHA instead of
a version tag.
---
 .github/workflows/markdown-check-format.yml                   | 2 +-
 .../dependency-scan/github-workflow-action-generate-sbom.yml  | 4 ++--
 .../github-workflow-action-scan-vulnerabilities.yml           | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/markdown-check-format.yml b/.github/workflows/markdown-check-format.yml
index a21eb85e..3b230534 100644
--- a/.github/workflows/markdown-check-format.yml
+++ b/.github/workflows/markdown-check-format.yml
@@ -11,7 +11,7 @@ jobs:
   markdown-check-format:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           fetch-depth: 0
       - run: |
diff --git a/tools/dependency-scan/github-workflow-action-generate-sbom.yml b/tools/dependency-scan/github-workflow-action-generate-sbom.yml
index 13d2096f..dee43327 100644
--- a/tools/dependency-scan/github-workflow-action-generate-sbom.yml
+++ b/tools/dependency-scan/github-workflow-action-generate-sbom.yml
@@ -9,12 +9,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@master
-    - uses: anchore/sbom-action@v0
+    - uses: anchore/sbom-action@f6c3d0fe42c3cf876e3462574e4c9416b5e0f07a #v0.9.0
       with:
         path: ./
         format: cyclonedx-json
         artifact-name: sbom-repo.cdx.json
-    - uses: anchore/sbom-action@v0
+    - uses: anchore/sbom-action@f6c3d0fe42c3cf876e3462574e4c9416b5e0f07a #v0.9.0
       with:
         image: my-registry.com/my/awesome/image
         registry-username: ${{ secrets.REGISTRY_USERNAME }}
diff --git a/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml b/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml
index 1ab2e453..c6b09191 100644
--- a/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml
+++ b/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml
@@ -8,13 +8,13 @@ jobs:
   scan-vulnerabilities:
     runs-on: ubuntu-latest
     steps:
-    - uses: anchore/scan-action@v3
+    - uses: anchore/scan-action@8576240a41341d866dbd7ebc72cd9fc0ef023f54 #v7.4.2
       with:
         sbom: sbom-repo.cdx.json
         fail-build: true
         severity-cutoff: critical
         acs-report-enable: true
-    - uses: anchore/scan-action@v3
+    - uses: anchore/scan-action@8576240a41341d866dbd7ebc72cd9fc0ef023f54 #v7.4.2
       with:
         sbom: sbom-image.cdx.json
         fail-build: true