From 3886a705e65a5fd965da630f5459e2ab3fd46026 Mon Sep 17 00:00:00 2001
From: Pawel Winogrodzki <pawelwi@microsoft.com>
Date: Thu, 20 Aug 2026 13:38:00 -0700
Subject: [PATCH 1/5] ci: pin GitHub Actions to commit SHAs

Replace mutable action tags and reusable workflow branches with full commit SHAs.

Keep version comments for maintainability.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3e4a178e-19a3-4caa-8a87-53fa6cabe7b9
---
 .github/actions/checkout-with-stable-pkgs/action.yml |  2 +-
 .github/workflows/check-circular-deps.yml            |  2 +-
 .github/workflows/check-clean-stage.yml              |  2 +-
 .github/workflows/check-entangled-specs.yml          |  4 ++--
 .github/workflows/check-files.yml                    |  2 +-
 .github/workflows/check-kernel-configs.yml           |  4 ++--
 .github/workflows/check-license-map.yml              |  4 ++--
 .github/workflows/check-manifests.yml                |  2 +-
 .github/workflows/check-package-builds.yml           |  2 +-
 .github/workflows/check-package-cgmanifest.yml       |  2 +-
 .github/workflows/check-package-update-gate.yml      |  2 +-
 .github/workflows/check-rendered-specs-stub.yml      |  2 +-
 .github/workflows/check-source-signatures.yml        |  4 ++--
 .github/workflows/check-spec.yml                     |  6 +++---
 .github/workflows/check-srpm-duplicates.yml          |  4 ++--
 .github/workflows/check-static-glibc.yml             |  4 ++--
 .github/workflows/go-test-coverage.yml               |  6 +++---
 .github/workflows/lint-specs.yml                     | 10 +++++-----
 .github/workflows/merge-conflict-check.yml           |  2 +-
 .github/workflows/quickstart_2.0.yml                 |  8 ++++----
 .github/workflows/spec-review-stub.yml               |  2 +-
 .github/workflows/verify-osguard-imageconfigs.yml    |  4 ++--
 22 files changed, 40 insertions(+), 40 deletions(-)

diff --git a/.github/actions/checkout-with-stable-pkgs/action.yml b/.github/actions/checkout-with-stable-pkgs/action.yml
index d3afae7b2b6..23d83bab60d 100644
--- a/.github/actions/checkout-with-stable-pkgs/action.yml
+++ b/.github/actions/checkout-with-stable-pkgs/action.yml
@@ -7,7 +7,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
         fetch-tags: true
diff --git a/.github/workflows/check-circular-deps.yml b/.github/workflows/check-circular-deps.yml
index e2830e96174..d92638990de 100644
--- a/.github/workflows/check-circular-deps.yml
+++ b/.github/workflows/check-circular-deps.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Determine DAILY_BUILD_ID value
         run: |
diff --git a/.github/workflows/check-clean-stage.yml b/.github/workflows/check-clean-stage.yml
index d9a33db7f54..131580bb4c3 100644
--- a/.github/workflows/check-clean-stage.yml
+++ b/.github/workflows/check-clean-stage.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/check-entangled-specs.yml b/.github/workflows/check-entangled-specs.yml
index 0e566b911ac..05adfca1cff 100644
--- a/.github/workflows/check-entangled-specs.yml
+++ b/.github/workflows/check-entangled-specs.yml
@@ -23,11 +23,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-files.yml b/.github/workflows/check-files.yml
index 9393d91b77f..f1e10f1a815 100644
--- a/.github/workflows/check-files.yml
+++ b/.github/workflows/check-files.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Get base commit for PRs
       if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/check-kernel-configs.yml b/.github/workflows/check-kernel-configs.yml
index 4f7c016938a..755022f6cbf 100644
--- a/.github/workflows/check-kernel-configs.yml
+++ b/.github/workflows/check-kernel-configs.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
@@ -44,7 +44,7 @@ jobs:
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-license-map.yml b/.github/workflows/check-license-map.yml
index 172e053501e..ef836a705ec 100644
--- a/.github/workflows/check-license-map.yml
+++ b/.github/workflows/check-license-map.yml
@@ -22,10 +22,10 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-manifests.yml b/.github/workflows/check-manifests.yml
index 0bcd4705bed..3d7f027e08b 100644
--- a/.github/workflows/check-manifests.yml
+++ b/.github/workflows/check-manifests.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # This PR runner uses an older Ubuntu with rpm version 4.17, which doesn't understand some newer macros like %bcond
     - name: Define missing rpm macros
diff --git a/.github/workflows/check-package-builds.yml b/.github/workflows/check-package-builds.yml
index ad8ee7ff449..3e075c6d30a 100644
--- a/.github/workflows/check-package-builds.yml
+++ b/.github/workflows/check-package-builds.yml
@@ -122,7 +122,7 @@ jobs:
               sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Checkout a stable version of the specs
         uses: ./.github/actions/checkout-with-stable-pkgs
diff --git a/.github/workflows/check-package-cgmanifest.yml b/.github/workflows/check-package-cgmanifest.yml
index 0190755c2e7..53bcb5c23ea 100644
--- a/.github/workflows/check-package-cgmanifest.yml
+++ b/.github/workflows/check-package-cgmanifest.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # This PR runner uses an older Ubuntu with rpm version 4.17, which doesn't understand some newer macros like %bcond
     - name: Define missing rpm macros
diff --git a/.github/workflows/check-package-update-gate.yml b/.github/workflows/check-package-update-gate.yml
index d506a8b6b25..cb5e54f77bf 100644
--- a/.github/workflows/check-package-update-gate.yml
+++ b/.github/workflows/check-package-update-gate.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Get base commit for PRs
       if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/check-rendered-specs-stub.yml b/.github/workflows/check-rendered-specs-stub.yml
index 8176fd7854b..c870a567947 100644
--- a/.github/workflows/check-rendered-specs-stub.yml
+++ b/.github/workflows/check-rendered-specs-stub.yml
@@ -32,7 +32,7 @@ jobs:
     # Prevent forks from running a stale/vulnerable copy of this stub with Actions enabled
     if: github.repository == 'microsoft/azurelinux'
     # Intentionally branch-pinned so the reusable workflow picks up updates automatically.
-    uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@4.0 # zizmor: ignore[unpinned-uses]
+    uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@b2b2b90f92842dc37bcd6f81c40e9b44ff8aea9a # 4.0
     permissions:
       contents: read
       pull-requests: write # Post/update/delete drift comments on PRs
diff --git a/.github/workflows/check-source-signatures.yml b/.github/workflows/check-source-signatures.yml
index a35622792a7..5fa8a06d36b 100644
--- a/.github/workflows/check-source-signatures.yml
+++ b/.github/workflows/check-source-signatures.yml
@@ -23,11 +23,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-spec.yml b/.github/workflows/check-spec.yml
index 295eef4fdbc..6b8c82d8bef 100644
--- a/.github/workflows/check-spec.yml
+++ b/.github/workflows/check-spec.yml
@@ -20,11 +20,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
@@ -57,7 +57,7 @@ jobs:
           echo "toolchain-spec-list=$(make --no-print-directory -sC toolkit printvar-toolchain_spec_list)" >> $GITHUB_ENV
 
       - name: Main branch checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: 'main'
           path: 'main-checkout'
diff --git a/.github/workflows/check-srpm-duplicates.yml b/.github/workflows/check-srpm-duplicates.yml
index f31cc6c8591..b5d6f2496a7 100644
--- a/.github/workflows/check-srpm-duplicates.yml
+++ b/.github/workflows/check-srpm-duplicates.yml
@@ -27,11 +27,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-static-glibc.yml b/.github/workflows/check-static-glibc.yml
index 536aeec60bb..9f918f299ae 100644
--- a/.github/workflows/check-static-glibc.yml
+++ b/.github/workflows/check-static-glibc.yml
@@ -21,11 +21,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/go-test-coverage.yml b/.github/workflows/go-test-coverage.yml
index 1f61c34cf8f..8ed9c0314cd 100644
--- a/.github/workflows/go-test-coverage.yml
+++ b/.github/workflows/go-test-coverage.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: '${{ env.EXPECTED_GO_VERSION }}'
       id: go
@@ -32,7 +32,7 @@ jobs:
         go version && which go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Check go.mod
       run: |
@@ -89,7 +89,7 @@ jobs:
         sudo env "PATH=$PATH" make go-test-coverage
 
     - name: Upload test coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: TestCoverage
         path: toolkit/out/tools/test_coverage_report.html
diff --git a/.github/workflows/lint-specs.yml b/.github/workflows/lint-specs.yml
index 7d0428888d5..b65cac32019 100644
--- a/.github/workflows/lint-specs.yml
+++ b/.github/workflows/lint-specs.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
@@ -48,7 +48,7 @@ jobs:
           echo "updated-specs=$(echo ${changed_specs})" >> $GITHUB_ENV
 
       - name: Main branch checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: 'main'
           path: 'main-checkout'
@@ -56,7 +56,7 @@ jobs:
       # Our linter is based on the spec-cleaner tool from the folks at openSUSE
       # We apply a patch to modify it for Azure Linux's needs
       - name: spec-cleaner checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: 'rpm-software-management/spec-cleaner'
           ref: 'spec-cleaner-1.2.0'
@@ -64,7 +64,7 @@ jobs:
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
@@ -98,7 +98,7 @@ jobs:
           fi
           exit 0
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ always() }}
         with:
           name: linted_specs
diff --git a/.github/workflows/merge-conflict-check.yml b/.github/workflows/merge-conflict-check.yml
index 01f0f44d183..8cdf99426c9 100644
--- a/.github/workflows/merge-conflict-check.yml
+++ b/.github/workflows/merge-conflict-check.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/quickstart_2.0.yml b/.github/workflows/quickstart_2.0.yml
index 9199e17e074..482df0c7994 100644
--- a/.github/workflows/quickstart_2.0.yml
+++ b/.github/workflows/quickstart_2.0.yml
@@ -19,12 +19,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         ref: '3.0-stable'
 
     - name: Set up Go 1.21
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: 1.21
       id: go
@@ -67,12 +67,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         ref: '3.0-stable'
 
     - name: Set up Go 1.21
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: 1.21
       id: go
diff --git a/.github/workflows/spec-review-stub.yml b/.github/workflows/spec-review-stub.yml
index e3a63355408..fc44b6d6289 100644
--- a/.github/workflows/spec-review-stub.yml
+++ b/.github/workflows/spec-review-stub.yml
@@ -38,7 +38,7 @@ jobs:
     if: github.repository == 'microsoft/azurelinux'
     # Intentionally branch-pinned to our own repo so the
     # reusable workflow picks up prompt/script/agent updates automatically.
-    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@4.0 # zizmor: ignore[unpinned-uses]
+    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@b2b2b90f92842dc37bcd6f81c40e9b44ff8aea9a # 4.0
     permissions:
       contents: read
       pull-requests: write # Post review comments and inline annotations on PRs
diff --git a/.github/workflows/verify-osguard-imageconfigs.yml b/.github/workflows/verify-osguard-imageconfigs.yml
index ce46a6a6e8b..0689a089c56 100644
--- a/.github/workflows/verify-osguard-imageconfigs.yml
+++ b/.github/workflows/verify-osguard-imageconfigs.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.x'
 

From c9999d11f843ba4e2aad3364596d22079be1d553 Mon Sep 17 00:00:00 2001
From: Pawel Winogrodzki <pawelwi@microsoft.com>
Date: Thu, 20 Aug 2026 13:47:51 -0700
Subject: [PATCH 2/5] ci: maintain pinned GitHub Actions with Dependabot

Keep intentional same-repository reusable workflow references on the 4.0 branch.

Add weekly grouped action updates with a seven-day cooldown.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3e4a178e-19a3-4caa-8a87-53fa6cabe7b9
---
 .github/dependabot.yml                          | 11 +++++++++++
 .github/workflows/check-rendered-specs-stub.yml |  2 +-
 .github/workflows/spec-review-stub.yml          |  2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..2c48305b7eb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/check-rendered-specs-stub.yml b/.github/workflows/check-rendered-specs-stub.yml
index c870a567947..8176fd7854b 100644
--- a/.github/workflows/check-rendered-specs-stub.yml
+++ b/.github/workflows/check-rendered-specs-stub.yml
@@ -32,7 +32,7 @@ jobs:
     # Prevent forks from running a stale/vulnerable copy of this stub with Actions enabled
     if: github.repository == 'microsoft/azurelinux'
     # Intentionally branch-pinned so the reusable workflow picks up updates automatically.
-    uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@b2b2b90f92842dc37bcd6f81c40e9b44ff8aea9a # 4.0
+    uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@4.0 # zizmor: ignore[unpinned-uses]
     permissions:
       contents: read
       pull-requests: write # Post/update/delete drift comments on PRs
diff --git a/.github/workflows/spec-review-stub.yml b/.github/workflows/spec-review-stub.yml
index fc44b6d6289..e3a63355408 100644
--- a/.github/workflows/spec-review-stub.yml
+++ b/.github/workflows/spec-review-stub.yml
@@ -38,7 +38,7 @@ jobs:
     if: github.repository == 'microsoft/azurelinux'
     # Intentionally branch-pinned to our own repo so the
     # reusable workflow picks up prompt/script/agent updates automatically.
-    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@b2b2b90f92842dc37bcd6f81c40e9b44ff8aea9a # 4.0
+    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@4.0 # zizmor: ignore[unpinned-uses]
     permissions:
       contents: read
       pull-requests: write # Post review comments and inline annotations on PRs

From f09271d8e438a5e414734d2dbfafd125b6cbc625 Mon Sep 17 00:00:00 2001
From: Pawel Winogrodzki <pawelwi@microsoft.com>
Date: Thu, 20 Aug 2026 15:33:38 -0700
Subject: [PATCH 3/5] ci: keep Dependabot config on default branch

Remove the config from the 3.0-dev change.

Dependabot reads configuration only from the default branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3e4a178e-19a3-4caa-8a87-53fa6cabe7b9
---
 .github/dependabot.yml | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 2c48305b7eb..00000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    groups:
-      github-actions:
-        patterns: ["*"]
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7

From d15b35886e667b2a79dccb0d9e3d006dcbc24c0f Mon Sep 17 00:00:00 2001
From: Pawel Winogrodzki <pawelwi@microsoft.com>
Date: Fri, 21 Aug 2026 10:07:41 -0700
Subject: [PATCH 4/5] ci: add Zizmor workflow check

Port the 4.0 workflow security check to 3.0-dev.

Run pedantic Zizmor validation for workflow changes and nightly scheduled checks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3e4a178e-19a3-4caa-8a87-53fa6cabe7b9
---
 .github/workflows/check-workflows.yml | 45 +++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/check-workflows.yml

diff --git a/.github/workflows/check-workflows.yml b/.github/workflows/check-workflows.yml
new file mode 100644
index 00000000000..ecb5fd4a92b
--- /dev/null
+++ b/.github/workflows/check-workflows.yml
@@ -0,0 +1,45 @@
+name: "Check workflows"
+on:
+  # Only trigger for changes that touch workflow files.
+  push:
+    branches: [ "3.0-dev" ]
+    paths: [ ".github/workflows/**" ]
+  pull_request:
+    branches: [ "3.0-dev" ]
+    paths: [ ".github/workflows/**" ]
+  workflow_dispatch:
+  schedule:
+    # Run every night at 3:15am PST (11:15am UTC)
+    - cron: '15 11 * * *'
+
+# Cancel in-progress runs of this workflow if a new run is triggered.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  check-workflows:
+    name: Check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up rust toolchain
+        run: rustup default stable
+
+      - name: Enable cargo cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      - name: Install zizmor
+        run: cargo install --locked zizmor
+
+      - name: Run zizmor
+        env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: zizmor --pedantic .

From 9cbaa173af1610e7d5b2805f3cba7f372632e0fa Mon Sep 17 00:00:00 2001
From: Pawel Winogrodzki <pawelwi@microsoft.com>
Date: Fri, 21 Aug 2026 10:13:20 -0700
Subject: [PATCH 5/5] ci: remove Zizmor workflow check

Avoid expanding this action-pinning change into remediation of existing workflow findings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3e4a178e-19a3-4caa-8a87-53fa6cabe7b9
---
 .github/workflows/check-workflows.yml | 45 ---------------------------
 1 file changed, 45 deletions(-)
 delete mode 100644 .github/workflows/check-workflows.yml

diff --git a/.github/workflows/check-workflows.yml b/.github/workflows/check-workflows.yml
deleted file mode 100644
index ecb5fd4a92b..00000000000
--- a/.github/workflows/check-workflows.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: "Check workflows"
-on:
-  # Only trigger for changes that touch workflow files.
-  push:
-    branches: [ "3.0-dev" ]
-    paths: [ ".github/workflows/**" ]
-  pull_request:
-    branches: [ "3.0-dev" ]
-    paths: [ ".github/workflows/**" ]
-  workflow_dispatch:
-  schedule:
-    # Run every night at 3:15am PST (11:15am UTC)
-    - cron: '15 11 * * *'
-
-# Cancel in-progress runs of this workflow if a new run is triggered.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check-workflows:
-    name: Check
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Set up rust toolchain
-        run: rustup default stable
-
-      - name: Enable cargo cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-
-      - name: Install zizmor
-        run: cargo install --locked zizmor
-
-      - name: Run zizmor
-        env:
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: zizmor --pedantic .