From 44f3f4330311ddc0dc6d41e58566936dcecb996e Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 12 Aug 2026 14:04:08 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml             | 11 +++++++++++
 .github/workflows/clang_format.yml |  4 ++--
 .github/workflows/test_docs.yml    |  6 +++---
 .github/workflows/test_macos.yml   |  2 +-
 .github/workflows/test_ubuntu.yml  |  2 +-
 .github/workflows/test_windows.yml |  4 ++--
 6 files changed, 20 insertions(+), 9 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..2c48305b7e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/clang_format.yml b/.github/workflows/clang_format.yml
index c6b7e00211..7edaf11d3d 100644
--- a/.github/workflows/clang_format.yml
+++ b/.github/workflows/clang_format.yml
@@ -5,9 +5,9 @@ jobs:
     name: Formatting Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Run clang-format style check for C/C++ programs.
-      uses: jidicula/clang-format-action@v4.4.1
+      uses: jidicula/clang-format-action@aecc1901f080e23c1bab6ccb1b2daa8d50eda274 # v4.4.1
       with:
         clang-format-version: '11'
         check-path: '.'
diff --git a/.github/workflows/test_docs.yml b/.github/workflows/test_docs.yml
index 587740bf57..ced40e3e3c 100644
--- a/.github/workflows/test_docs.yml
+++ b/.github/workflows/test_docs.yml
@@ -8,10 +8,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: '3.7'
           architecture: 'x64'
@@ -39,7 +39,7 @@ jobs:
 
       # Only on commits to 'main' branch
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test_macos.yml b/.github/workflows/test_macos.yml
index 7259ebc9e8..1732e2d048 100644
--- a/.github/workflows/test_macos.yml
+++ b/.github/workflows/test_macos.yml
@@ -12,7 +12,7 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Setup
         run: ./setup.sh
diff --git a/.github/workflows/test_ubuntu.yml b/.github/workflows/test_ubuntu.yml
index 446a9579f5..97f270031d 100644
--- a/.github/workflows/test_ubuntu.yml
+++ b/.github/workflows/test_ubuntu.yml
@@ -11,7 +11,7 @@ jobs:
         os: [ubuntu-18.04, ubuntu-20.04]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Setup
         run: ./setup.sh
diff --git a/.github/workflows/test_windows.yml b/.github/workflows/test_windows.yml
index 80acfc2ca4..cd122a0e5a 100644
--- a/.github/workflows/test_windows.yml
+++ b/.github/workflows/test_windows.yml
@@ -9,10 +9,10 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Enable Developer Command Prompt
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
 
       - name: Build AirLib
         shell: cmd