From a0536e93941dcb26c6ef35991ada3b43fa300053 Mon Sep 17 00:00:00 2001
From: Jake Bailey <5341706+jakebailey@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:57:20 -0700
Subject: [PATCH 1/2] Update and pin GHA actions

---
 .github/disabled-workflows/new-release-branch.yaml | 2 +-
 .github/disabled-workflows/set-version.yaml        | 2 +-
 .github/disabled-workflows/sync-branch.yaml        | 2 +-
 .github/workflows/accept-baselines-fix-lints.yaml  | 2 +-
 .github/workflows/ci.yml                           | 1 -
 .github/workflows/close-issues.yml                 | 2 +-
 .github/workflows/create-cherry-pick-pr.yml        | 4 ++--
 .github/workflows/sync-wiki.yml                    | 2 +-
 8 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/disabled-workflows/new-release-branch.yaml b/.github/disabled-workflows/new-release-branch.yaml
index 8aac9c8d0064a..58bd6310c1603 100644
--- a/.github/disabled-workflows/new-release-branch.yaml
+++ b/.github/disabled-workflows/new-release-branch.yaml
@@ -116,7 +116,7 @@ jobs:
           BRANCH_NAME: ${{ inputs.branch_name }}
         run: git push --set-upstream origin "$BRANCH_NAME"
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@08bcbbf253fd6bc533dd8b9ab47a58582be57fbe # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: "I've created ${{ inputs.branch_name }} with version ${{ inputs.package_version }} for you."
diff --git a/.github/disabled-workflows/set-version.yaml b/.github/disabled-workflows/set-version.yaml
index c1a328c60c2ee..dd58152a1dcb6 100644
--- a/.github/disabled-workflows/set-version.yaml
+++ b/.github/disabled-workflows/set-version.yaml
@@ -117,7 +117,7 @@ jobs:
           git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
       - run: git push
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@08bcbbf253fd6bc533dd8b9ab47a58582be57fbe # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: "I've set the version of ${{ inputs.branch_name }} to ${{ inputs.package_version }} for you."
diff --git a/.github/disabled-workflows/sync-branch.yaml b/.github/disabled-workflows/sync-branch.yaml
index 9a104d555c8da..4c19e1e67d60a 100644
--- a/.github/disabled-workflows/sync-branch.yaml
+++ b/.github/disabled-workflows/sync-branch.yaml
@@ -91,7 +91,7 @@ jobs:
           git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
       - run: git push
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@08bcbbf253fd6bc533dd8b9ab47a58582be57fbe # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: "I've pulled main into ${{ inputs.branch_name }} for you."
diff --git a/.github/workflows/accept-baselines-fix-lints.yaml b/.github/workflows/accept-baselines-fix-lints.yaml
index 4ccf7c7be0186..6bf74270edd0c 100644
--- a/.github/workflows/accept-baselines-fix-lints.yaml
+++ b/.github/workflows/accept-baselines-fix-lints.yaml
@@ -45,7 +45,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
+        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7697847d16de..bacc35bff64f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,6 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 'lts/*'
-      - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 # stable
       - uses: ./.github/actions/setup-go
       - run: npm ci
       - run: npx hereby typescript:release --forRelease --setPrerelease dev.0.0
diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml
index 30180bd258815..65659866eef72 100644
--- a/.github/workflows/close-issues.yml
+++ b/.github/workflows/close-issues.yml
@@ -38,7 +38,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
+        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml
index be2112ddca5ad..850de7865c1d2 100644
--- a/.github/workflows/create-cherry-pick-pr.yml
+++ b/.github/workflows/create-cherry-pick-pr.yml
@@ -63,7 +63,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
+        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
@@ -205,7 +205,7 @@ jobs:
 
             return commentBody;
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@08bcbbf253fd6bc533dd8b9ab47a58582be57fbe # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: ${{ steps.open-pr.outputs.result }}
diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml
index 7939c09daf646..a8632b8f85a2e 100644
--- a/.github/workflows/sync-wiki.yml
+++ b/.github/workflows/sync-wiki.yml
@@ -34,7 +34,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
+        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}

From 38cf0227bd13c1ba68bf1a21fe8e507455d286ea Mon Sep 17 00:00:00 2001
From: Jake Bailey <5341706+jakebailey@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:11:10 -0700
Subject: [PATCH 2/2] Restore working Key Vault action pin

---
 .github/workflows/accept-baselines-fix-lints.yaml | 2 +-
 .github/workflows/close-issues.yml                | 2 +-
 .github/workflows/create-cherry-pick-pr.yml       | 2 +-
 .github/workflows/sync-wiki.yml                   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/accept-baselines-fix-lints.yaml b/.github/workflows/accept-baselines-fix-lints.yaml
index 6bf74270edd0c..4ccf7c7be0186 100644
--- a/.github/workflows/accept-baselines-fix-lints.yaml
+++ b/.github/workflows/accept-baselines-fix-lints.yaml
@@ -45,7 +45,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
+        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml
index 65659866eef72..30180bd258815 100644
--- a/.github/workflows/close-issues.yml
+++ b/.github/workflows/close-issues.yml
@@ -38,7 +38,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
+        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml
index 850de7865c1d2..3313c7cb61ff9 100644
--- a/.github/workflows/create-cherry-pick-pr.yml
+++ b/.github/workflows/create-cherry-pick-pr.yml
@@ -63,7 +63,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
+        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml
index a8632b8f85a2e..7939c09daf646 100644
--- a/.github/workflows/sync-wiki.yml
+++ b/.github/workflows/sync-wiki.yml
@@ -34,7 +34,7 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
       - name: Create GitHub App token
         id: app-token
-        uses: microsoft/create-github-app-token-via-key-vault@9dee9fa4d9557db659576ba9109d74d762a0e666 # main
+        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
         with:
           client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
           key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}