From ff1a3cfd0a5ed3da786e60cbdfbaf9560ccafb5e Mon Sep 17 00:00:00 2001 From: Dan Fiedler <151573964+danfiedler-msft@users.noreply.github.com> Date: Thu, 3 Sep 2026 15:06:56 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs (#561) * Pin GitHub Actions to full-length commit SHAs * style: fix dependabot.yml indentation and trailing newline Prettier Check was failing on .github/dependabot.yml: 'default-days' was indented 7 spaces instead of 8 (tabWidth is 3, and 'cooldown:' sits at 5), and the file was missing a trailing newline. --------- Co-authored-by: Suneha Bose --- .github/dependabot.yml | 2 ++ .github/workflows/codeql.yml | 8 ++++---- .github/workflows/release-pr.yml | 2 +- .github/workflows/run-integration-tests-private.yml | 2 +- 4 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d806d992..ce1df997 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,5 @@ updates: actions: patterns: - '*' + cooldown: + default-days: 7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5a5ea272..b8a7e9d6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # We must fetch at least the immediate parents so that if this is # a pull request then we can checkout the head. @@ -24,7 +24,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a #v3.29.5 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 # Override language selection by uncommenting this and choosing your languages # with: # languages: go, javascript, csharp, python, cpp, java @@ -32,7 +32,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a #v3.29.5 + uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -46,4 +46,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a #v3.29.5 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml index a3a46204..f85a3962 100644 --- a/.github/workflows/release-pr.yml +++ b/.github/workflows/release-pr.yml @@ -13,6 +13,6 @@ jobs: permissions: actions: read contents: write - uses: Azure/action-release-workflows/.github/workflows/release_js_project.yaml@3c677ba5ab58f5c5c1a6f0cfb176b333b1f27405 # v1 + uses: Azure/action-release-workflows/.github/workflows/release_js_project.yaml@3c677ba5ab58f5c5c1a6f0cfb176b333b1f27405 # v1.0.3 with: changelogPath: ./CHANGELOG.md diff --git a/.github/workflows/run-integration-tests-private.yml b/.github/workflows/run-integration-tests-private.yml index 1bdbe2d9..a06f125b 100644 --- a/.github/workflows/run-integration-tests-private.yml +++ b/.github/workflows/run-integration-tests-private.yml @@ -30,7 +30,7 @@ jobs: run: npm run build - name: Azure login - uses: azure/login@v3.0.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }}