From 52a77ea68024079691eac6240bf858883b609727 Mon Sep 17 00:00:00 2001 From: "Prekshith DJ (Persistent Systems Limited)" Date: Mon, 17 Aug 2026 16:44:15 +0530 Subject: [PATCH 1/2] Pin GitHub Actions to commit SHAs --- .github/workflows/azd-template-validation.yml | 4 ++-- .github/workflows/azure-dev.yml | 6 +++--- .github/workflows/broken-links-checker.yml | 6 +++--- .github/workflows/pr-title-checker.yml | 2 +- .github/workflows/stale-bot.yml | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/azd-template-validation.yml b/.github/workflows/azd-template-validation.yml index 82f1a558..2f75f8c4 100644 --- a/.github/workflows/azd-template-validation.yml +++ b/.github/workflows/azd-template-validation.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest name: azd template validation steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: submodules: recursive @@ -33,7 +33,7 @@ jobs: run: | yq -i 'del(.hooks.postprovision[] | select(.run == "./submodules/ai-landing-zone/bicep/scripts/postprovision.ps1"))' azure.yaml - - uses: microsoft/template-validation-action@Latest + - uses: microsoft/template-validation-action@bae4895d0a8abd4f0d5aad68ae8647b3027f4c91 # Latest with: validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }} useDevContainer: ${{ vars.TEMPLATE_USE_DEV_CONTAINER }} diff --git a/.github/workflows/azure-dev.yml b/.github/workflows/azure-dev.yml index 5d8f6380..8d3710e3 100644 --- a/.github/workflows/azure-dev.yml +++ b/.github/workflows/azure-dev.yml @@ -28,7 +28,7 @@ jobs: TEMP: /tmp steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: submodules: recursive @@ -40,7 +40,7 @@ jobs: echo "Using unique AZURE_ENV_NAME: ${AZURE_ENV_NAME}-${SUFFIX}" - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Azure Developer CLI Login run: | @@ -51,7 +51,7 @@ jobs: shell: pwsh - name: Azure CLI Login - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml index 9901fa11..5fb81616 100644 --- a/.github/workflows/broken-links-checker.yml +++ b/.github/workflows/broken-links-checker.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 @@ -34,7 +34,7 @@ jobs: - name: Check Broken Links in Changed Markdown Files id: lychee-check-pr if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true' - uses: lycheeverse/lychee-action@v2.4.1 + uses: lycheeverse/lychee-action@82202e5e9c2f4ef1a55a3d02563e1cb6041e5332 # v2.4.1 with: args: > --verbose --exclude-mail --no-progress --exclude ^https?:// @@ -47,7 +47,7 @@ jobs: - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger) id: lychee-check-manual if: github.event_name == 'workflow_dispatch' - uses: lycheeverse/lychee-action@v2.4.1 + uses: lycheeverse/lychee-action@82202e5e9c2f4ef1a55a3d02563e1cb6041e5332 # v2.4.1 with: args: > --verbose --exclude-mail --no-progress --exclude ^https?:// diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml index b7e70e56..bf274442 100644 --- a/.github/workflows/pr-title-checker.yml +++ b/.github/workflows/pr-title-checker.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'merge_group' }} steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml index abcd68d3..e250e866 100644 --- a/.github/workflows/stale-bot.yml +++ b/.github/workflows/stale-bot.yml @@ -12,7 +12,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9 with: stale-issue-message: "This issue is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 30 days." days-before-stale: 180 From f405c7b6d966b10ca166f11d4de5e13ab46b4c94 Mon Sep 17 00:00:00 2001 From: "Prekshith DJ (Persistent Systems Limited)" Date: Wed, 19 Aug 2026 17:58:44 +0530 Subject: [PATCH 2/2] resolved the comments --- .github/workflows/create-release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 5eeaf901..791459bf 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -14,11 +14,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.event.workflow_run.head_sha }} - - uses: codfish/semantic-release-action@v3 + - uses: docker://ghcr.io/codfish/semantic-release-action@sha256:c6a4e05d93f73f2870887434c1286df7a23a55770be16cb826b6e2432f92e650 # v5.0.0 id: semantic with: tag-format: "v${version}"