From 4b210cc214fe3c3ad4e608addaca80f75ff9e869 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 19 Aug 2026 10:16:56 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                       |  2 ++
 .github/workflows/ci.yml                     | 14 +++++++-------
 .github/workflows/record-macos-snapshots.yml |  4 ++--
 3 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ab32ff..c0fa85b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: swift
     directory: /
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a0820d..9a27fc0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install SwiftLint if missing
         run: |
@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run package tests with xcodebuild
         run: |
@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload failed snapshots
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: failed-snapshots-iOS
           path: /tmp/failed-snapshots/
@@ -66,7 +66,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run package tests with xcodebuild
         run: |
@@ -84,7 +84,7 @@ jobs:
 
       - name: Upload failed snapshots
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: failed-snapshots-macOS
           path: /tmp/failed-snapshots/
@@ -97,7 +97,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install XcodeGen if missing
         run: |
@@ -116,7 +116,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install XcodeGen if missing
         run: |
diff --git a/.github/workflows/record-macos-snapshots.yml b/.github/workflows/record-macos-snapshots.yml
index 8781be7..6a46a84 100644
--- a/.github/workflows/record-macos-snapshots.yml
+++ b/.github/workflows/record-macos-snapshots.yml
@@ -13,7 +13,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Enable recording mode
         run: |
@@ -50,7 +50,7 @@ jobs:
 
       - name: Upload recorded snapshots
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: macos-snapshots
           path: /tmp/recorded-snapshots/