From 603273a9e48ab8d0df00ff5ea49c0f2496e04cfe Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 12 Aug 2026 14:59:17 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                           | 11 +++++++++++
 .github/workflows/info-needed-closer.yml         |  2 +-
 .github/workflows/jobs.yml                       |  6 +++---
 .github/workflows/locker.yml                     |  2 +-
 .github/workflows/packages.yml                   |  2 +-
 .github/workflows/release-pipeline-templates.yml |  4 ++--
 6 files changed, 19 insertions(+), 8 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..2c48305b7e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/info-needed-closer.yml b/.github/workflows/info-needed-closer.yml
index dcfb30b7af..b152679021 100644
--- a/.github/workflows/info-needed-closer.yml
+++ b/.github/workflows/info-needed-closer.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Close Info Needed Issues
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           DAYS: ${{ inputs.days || '14' }}
         with:
diff --git a/.github/workflows/jobs.yml b/.github/workflows/jobs.yml
index 4ff9b46768..cb45c14f03 100644
--- a/.github/workflows/jobs.yml
+++ b/.github/workflows/jobs.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       # Setup
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       # GitHub (unlike AzDO) can't enforce an enum on a workflow_call input, so
       # fail the build when package_manager isn't one we support. The step is
       # skipped entirely when the value is valid.
@@ -39,7 +39,7 @@ jobs:
         if: ${{ inputs.package_manager == 'pnpm' }}
         run: corepack enable && corepack prepare --activate
       - name: Using Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager == 'pnpm' && 'pnpm' || '' }}
@@ -57,7 +57,7 @@ jobs:
       # Package
       - run: ${{ inputs.package_manager }} run package
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: "Artifacts-${{ inputs.working_directory }}"
           path: |
diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml
index b995720af9..a2d382c877 100644
--- a/.github/workflows/locker.yml
+++ b/.github/workflows/locker.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lock Inactive Closed Issues
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           DAYS: ${{ inputs.days || '28' }}
         with:
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index 053132dcfe..ed21e5c609 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Determine changed packages
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/release-pipeline-templates.yml b/.github/workflows/release-pipeline-templates.yml
index 61f291cfe8..ca44f95f56 100644
--- a/.github/workflows/release-pipeline-templates.yml
+++ b/.github/workflows/release-pipeline-templates.yml
@@ -24,13 +24,13 @@ jobs:
 
       - name: Generate token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
         with:
           app-id: ${{ secrets.AZURETOOLS_VSCODE_BOT_APP_ID }}
           private-key: ${{ secrets.AZURETOOLS_VSCODE_BOT_APP_PRIVATE_KEY }}
 
       - name: Checkout main
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
           fetch-depth: 0