Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci-linux.yml

@@ -23,10 +23,10 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
         with:
           node-version: '20'
           # Set this option if you want the action to check for the latest available version that satisfies the version spec
@@ -39,7 +39,7 @@ jobs:
         run: yarn compile-production
 
       - name: Run the tests
-        uses: GabrielBB/xvfb-action@v1.4
+        uses: GabrielBB/xvfb-action@f040be23a619e5ec34116f24098ad3626ceab681 # v1.4
         with:
           # Command to execute using xvfb
           run: yarn test

.github/workflows/ci-windows.yml

@@ -23,10 +23,10 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
         with:
           node-version: '20'
           # Set this option if you want the action to check for the latest available version that satisfies the version spec

.github/workflows/close-fixed-pending-release.yml

@@ -8,7 +8,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Close issues marked 'fixed-pending-release'
-              uses: gcampbell-msft/fixed-pending-release@0.0.12
+              uses: gcampbell-msft/fixed-pending-release@507d604e212f33d2ce86278691a311f330261d06 # 0.0.12
               with:
                 token: ${{ secrets.GITHUB_TOKEN }}
                 label: fixed-pending-release

.github/workflows/main.yml

@@ -18,10 +18,10 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v2.1.2
+        uses: actions/setup-node@c6fd00ceb9747fb23ffdf72987450a2664414867 # v2.1.2
         with:
           node-version: '20'
           check-latest: true
@@ -44,7 +44,7 @@ jobs:
           yarn run package
 
       - name: Upload a Build Artifact
-        uses: actions/upload-artifact@v2.1.4
+        uses: actions/upload-artifact@58740802ef971a2d71eff71e63d48ab68d1f5507 # v2.1.4
         with:
           name: makefile-tools.vsix
           path: ./makefile-tools.vsix

.github/workflows/stale-issues.yml

@@ -19,7 +19,7 @@ jobs:
             stale-exempt-label: stale-exempt
             only-label: more info needed
         steps:
-        - uses: actions/stale@v4.1.1
+        - uses: actions/stale@a20b814fb01b71def3bd6f56e7494d667ddf28da # v4.1.1
           with:
             stale-issue-label: ${{ env.stale-label }}
             exempt-issue-labels: ${{ env.stale-exempt-label }}

.github/workflows/triage-issues.yml

@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add triage label
-        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 # 1.0.4
         with:
           add-labels: triage