From 0d76d5a1bb494ec2fb777675d86276cbb348b18a Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 23:40:27 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 4 +++- .github/workflows/ci.yml | 4 ++-- .github/workflows/generate.yml | 8 ++++---- .github/workflows/update-samples.yml | 8 ++++---- 4 files changed, 13 insertions(+), 11 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7315d458..423ef95f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,6 +12,8 @@ updates: schedule: interval: "weekly" day: "sunday" + cooldown: + default-days: 7 - package-ecosystem: dotnet-sdk directory: / schedule: @@ -21,4 +23,4 @@ updates: - dependency-name: '*' update-types: - version-update:semver-major - - version-update:semver-minor + - version-update:semver-minor \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4869d138..c48db1fd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,13 +13,13 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # avoid shallow clone so nbgv can do its work. submodules: true - name: Setup .NET Core - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - name: Build run: | diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml index fb569c79..e801f6eb 100644 --- a/.github/workflows/generate.yml +++ b/.github/workflows/generate.yml @@ -16,16 +16,16 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # avoid shallow clone so nbgv can do its work. submodules: true - name: Setup .NET Core - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - name: Clone bicep-types-az - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Azure/bicep-types-az path: workflow-temp/bicep-types-az @@ -47,7 +47,7 @@ jobs: --verbose - name: Upload Generated - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: generated path: ${{ runner.temp }}/generated diff --git a/.github/workflows/update-samples.yml b/.github/workflows/update-samples.yml index d7ee7a9a..a13d31f6 100644 --- a/.github/workflows/update-samples.yml +++ b/.github/workflows/update-samples.yml @@ -17,15 +17,15 @@ jobs: DOTNET_CLI_TELEMETRY_OPTOUT: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # avoid shallow clone so nbgv can do its work. - name: Setup .NET Core - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 - name: Clone quickstarts - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Azure/azure-quickstart-templates path: workflow-temp/azure-quickstart-templates @@ -40,7 +40,7 @@ jobs: continue-on-error: true - name: Commit and push - uses: stefanzweifel/git-auto-commit-action@v7 + uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 with: commit_message: Update Quickstart & AVM samples file_pattern: settings/samples src/TemplateRefGenerator.Tests/Files