Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/pr.yml

@@ -9,7 +9,7 @@ jobs:
     name: Setup Check
     runs-on: windows-2022
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: yarn install
       run: yarn install
@@ -75,4 +75,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [setupcheck, call-runcodegen, call-testcli, call-buildnpmpackage, call-buildrnx]
     steps:
-     - uses: actions/checkout@v4
+     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

.github/workflows/publish.yml

@@ -17,10 +17,10 @@ jobs:
     needs: call-runcodegen
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: 18
         registry-url: https://registry.npmjs.org/
@@ -38,7 +38,7 @@ jobs:
       working-directory: package
 
     - name: upload npm logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: npm-logs
         path: /home/runner/.npm/_logs

.github/workflows/template-buildexample.yml

@@ -21,7 +21,7 @@ jobs:
     name: Build ${{ inputs.exampleName }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: yarn install
       run: yarn install
@@ -55,7 +55,7 @@ jobs:
       working-directory: ${{ inputs.exampleName }}
 
     - name: Upload appx
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ inputs.exampleName }} appx
         path: ${{ inputs.exampleName }}\windows\AppPackages\${{ inputs.exampleName }}\${{ inputs.exampleName }}_1.0.0.0_x64_Debug_Test

.github/workflows/template-buildnpmpackage.yml

@@ -13,7 +13,7 @@ jobs:
     name: Build NPM Package
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: yarn install
       run: yarn install 
@@ -26,7 +26,7 @@ jobs:
       working-directory: package
 
     - name: Upload npm package
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: RNX npm package
         path: package\*.tgz

.github/workflows/template-buildrnx.yml

@@ -21,10 +21,10 @@ jobs:
     name: Build RNX ${{ inputs.configuration }} ${{ inputs.platform }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: setup-msbuild
-      uses: microsoft/setup-msbuild@v2
+      uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0
 
     - name: yarn install
       run: yarn install 
@@ -36,7 +36,7 @@ jobs:
       run: msbuild /restore /p:RestoreLockedMode=true /p:RestorePackagesConfig=true package\windows\ReactNativeXaml.sln /p:configuration=${{ inputs.configuration }} /p:platform=${{ inputs.platform }}
 
     - name: Upload build output
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: RNX ${{ inputs.configuration }} ${{ inputs.platform }} Build Output
         path: package\windows\${{ inputs.platform }}\${{ inputs.configuration }}\ReactNativeXaml\*.*

.github/workflows/template-runcodegen.yml

@@ -18,12 +18,12 @@ jobs:
         git config --global core.autocrlf false
         git config --global core.filemode false
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: yarn install
       run: yarn install
 
-    - uses: nuget/setup-nuget@v1
+    - uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f # v1.2.0
 
     - name: NuGet restore
       run: nuget restore -LockedMode package\windows\ReactNativeXaml.sln

.github/workflows/template-testcli.yml

@@ -21,7 +21,7 @@ jobs:
     name: New RNW@${{ inputs.rnwVersion }} App
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: yarn install
       run: yarn install