From c66964efe6a6cf3117d548a64054dd99125fd55e Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 13:59:23 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/ci-linux.yml | 6 +++--- .github/workflows/ci-windows.yml | 4 ++-- .github/workflows/close-fixed-pending-release.yml | 2 +- .github/workflows/main.yml | 6 +++--- .github/workflows/stale-issues.yml | 2 +- .github/workflows/triage-issues.yml | 2 +- 7 files changed, 22 insertions(+), 11 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci-linux.yml b/.github/workflows/ci-linux.yml index 8a49ac83..ce1f93d1 100644 --- a/.github/workflows/ci-linux.yml +++ b/.github/workflows/ci-linux.yml @@ -23,10 +23,10 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup Node.js environment - uses: actions/setup-node@v2 + uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2 with: node-version: '20' # Set this option if you want the action to check for the latest available version that satisfies the version spec @@ -39,7 +39,7 @@ jobs: run: yarn compile-production - name: Run the tests - uses: GabrielBB/xvfb-action@v1.4 + uses: GabrielBB/xvfb-action@f040be23a619e5ec34116f24098ad3626ceab681 # v1.4 with: # Command to execute using xvfb run: yarn test diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml index c1f2ddf8..434adf6e 100644 --- a/.github/workflows/ci-windows.yml +++ b/.github/workflows/ci-windows.yml @@ -23,10 +23,10 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup Node.js environment - uses: actions/setup-node@v2 + uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2 with: node-version: '20' # Set this option if you want the action to check for the latest available version that satisfies the version spec diff --git a/.github/workflows/close-fixed-pending-release.yml b/.github/workflows/close-fixed-pending-release.yml index 2e59b262..1055cebf 100644 --- a/.github/workflows/close-fixed-pending-release.yml +++ b/.github/workflows/close-fixed-pending-release.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Close issues marked 'fixed-pending-release' - uses: gcampbell-msft/fixed-pending-release@0.0.12 + uses: gcampbell-msft/fixed-pending-release@507d604e212f33d2ce86278691a311f330261d06 # 0.0.12 with: token: ${{ secrets.GITHUB_TOKEN }} label: fixed-pending-release \ No newline at end of file diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 7d2a5326..e426fcae 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -18,10 +18,10 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup Node.js environment - uses: actions/setup-node@v2.1.2 + uses: actions/setup-node@c6fd00ceb9747fb23ffdf72987450a2664414867 # v2.1.2 with: node-version: '20' check-latest: true @@ -44,7 +44,7 @@ jobs: yarn run package - name: Upload a Build Artifact - uses: actions/upload-artifact@v2.1.4 + uses: actions/upload-artifact@58740802ef971a2d71eff71e63d48ab68d1f5507 # v2.1.4 with: name: makefile-tools.vsix path: ./makefile-tools.vsix diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml index 6f39a1ce..34ea7741 100644 --- a/.github/workflows/stale-issues.yml +++ b/.github/workflows/stale-issues.yml @@ -19,7 +19,7 @@ jobs: stale-exempt-label: stale-exempt only-label: more info needed steps: - - uses: actions/stale@v4.1.1 + - uses: actions/stale@a20b814fb01b71def3bd6f56e7494d667ddf28da # v4.1.1 with: stale-issue-label: ${{ env.stale-label }} exempt-issue-labels: ${{ env.stale-exempt-label }} diff --git a/.github/workflows/triage-issues.yml b/.github/workflows/triage-issues.yml index 09ee57ab..a45fc58a 100644 --- a/.github/workflows/triage-issues.yml +++ b/.github/workflows/triage-issues.yml @@ -14,6 +14,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Add triage label - uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 + uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 # 1.0.4 with: add-labels: triage