From e072fefd259249044c68e5514b03c6910d0e0e6c Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 15:01:47 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/build.yml | 18 +++++++++--------- .github/workflows/health-check.yml | 6 +++--- .github/workflows/no-response.yml | 2 +- .github/workflows/triage-agent.yml | 4 ++-- .github/workflows/triage-all-open-issues.yml | 4 ++-- 6 files changed, 26 insertions(+), 17 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8cc8a033..a4a0cf03 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,12 @@ updates: # in case the feed's ingestion lag drifts. cooldown: default-days: 10 + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5e8d27c9..db4dfa74 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup Build Environment run: | @@ -22,13 +22,13 @@ jobs: sleep 3 - name: Set up JDK 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: 'temurin' java-version: '21' - name: Setup Node.js environment - uses: actions/setup-node@v2 + uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2 with: node-version: 20 @@ -65,16 +65,16 @@ jobs: runs-on: windows-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Set up JDK 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: 'temurin' java-version: '21' - name: Setup Node.js environment - uses: actions/setup-node@v2 + uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2 with: node-version: 20 @@ -105,16 +105,16 @@ jobs: runs-on: macos-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Set up JDK 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1 with: distribution: 'temurin' java-version: '21' - name: Setup Node.js environment - uses: actions/setup-node@v2 + uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2 with: node-version: 20 diff --git a/.github/workflows/health-check.yml b/.github/workflows/health-check.yml index 3867e1d5..d0179698 100644 --- a/.github/workflows/health-check.yml +++ b/.github/workflows/health-check.yml @@ -30,10 +30,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Node.js environment - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 @@ -42,7 +42,7 @@ jobs: - name: Open issue on scheduled failure if: failure() && github.event_name == 'schedule' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`; diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index ce02ae9a..9edc36f6 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -16,7 +16,7 @@ jobs: permissions: issues: write steps: - - uses: lee-dohm/no-response@9bb0a4b5e6a45046f00353d5de7d90fb8bd773bb #v0.5.0 + - uses: lee-dohm/no-response@9bb0a4b5e6a45046f00353d5de7d90fb8bd773bb # v0.5.0 with: token: ${{ github.token }} daysUntilClose: 14 diff --git a/.github/workflows/triage-agent.yml b/.github/workflows/triage-agent.yml index c602264e..9df56bc5 100644 --- a/.github/workflows/triage-agent.yml +++ b/.github/workflows/triage-agent.yml @@ -21,11 +21,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Get issue data id: get_issue - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const eventName = context.eventName; diff --git a/.github/workflows/triage-all-open-issues.yml b/.github/workflows/triage-all-open-issues.yml index 092f4ef7..05dae014 100644 --- a/.github/workflows/triage-all-open-issues.yml +++ b/.github/workflows/triage-all-open-issues.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Get all open issues id: get_issues - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | // Use Search API to filter issues at API level @@ -85,7 +85,7 @@ jobs: - name: Trigger triage workflow for issue if: inputs.dry_run != true - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const issueNumber = '${{ matrix.issue_number }}';