From 80ff137a3bbb25b711cec632a158172c839374a3 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Sun, 23 Aug 2026 12:59:49 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                  | 11 +++++++++++
 .github/workflows/docs_mrtk2.yaml       |  2 +-
 .github/workflows/issue_labeler.yaml    |  2 +-
 .github/workflows/pr_labeler.yaml       |  2 +-
 .github/workflows/validation_mrtk2.yaml |  2 +-
 5 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..2c48305b7eb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/docs_mrtk2.yaml b/.github/workflows/docs_mrtk2.yaml
index b15801c0a47..c6a99f87b35 100644
--- a/.github/workflows/docs_mrtk2.yaml
+++ b/.github/workflows/docs_mrtk2.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Validate docs
       run: |
diff --git a/.github/workflows/issue_labeler.yaml b/.github/workflows/issue_labeler.yaml
index d0faf7b25bd..dba1cb5259a 100644
--- a/.github/workflows/issue_labeler.yaml
+++ b/.github/workflows/issue_labeler.yaml
@@ -11,7 +11,7 @@ jobs:
   label-issue:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             if (context.payload.issue.title.toLowerCase().includes("mrtk3") ||
diff --git a/.github/workflows/pr_labeler.yaml b/.github/workflows/pr_labeler.yaml
index 4701ee19715..009174dfcbd 100644
--- a/.github/workflows/pr_labeler.yaml
+++ b/.github/workflows/pr_labeler.yaml
@@ -11,7 +11,7 @@ jobs:
   label-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             if (context.payload.pull_request.base.ref == 'mrtk3')
diff --git a/.github/workflows/validation_mrtk2.yaml b/.github/workflows/validation_mrtk2.yaml
index 4610f2ce6b8..c51458de929 100644
--- a/.github/workflows/validation_mrtk2.yaml
+++ b/.github/workflows/validation_mrtk2.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Get Pull Request changes
       if: github.event_name == 'pull_request'