From c8f362d330848355511c4360fc486f06c8a0af82 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 12 Aug 2026 11:56:12 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                          | 2 ++
 .github/workflows/ci.yml                        | 4 ++--
 .github/workflows/official-build.yml            | 4 ++--
 .github/workflows/on-push-verification.yml      | 6 +++---
 .github/workflows/sample-workflow.yml           | 8 ++++----
 .github/workflows/self-hosted-validation-v1.yml | 4 ++--
 6 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4c158bd8..8a55deca 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,3 +17,5 @@ updates:
       - "dependencies"
     commit-message:
       prefix: "fix(ci)"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d738944d..3b2e7a26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '24'
 
diff --git a/.github/workflows/official-build.yml b/.github/workflows/official-build.yml
index 99ce274d..33419a76 100644
--- a/.github/workflows/official-build.yml
+++ b/.github/workflows/official-build.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Extract branch name
       shell: bash
@@ -25,7 +25,7 @@ jobs:
       id: extract_branch
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '24'
 
diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index 4bd35a88..8faae089 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
       # Checkout your code repository to scan
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Run analyzers
     - uses: ./
@@ -30,13 +30,13 @@ jobs:
 
       # Upload alerts to the Security tab
     - name: Upload alerts to Security tab
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
       with:
         sarif_file: ${{ steps.msdo.outputs.sarifFile }}
 
       # Upload alerts file as a workflow artifact
     - name: Upload alerts file as a workflow artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:  
         name: alerts-${{ matrix.os }}
         path: ${{ steps.msdo.outputs.sarifFile }}
diff --git a/.github/workflows/sample-workflow.yml b/.github/workflows/sample-workflow.yml
index 77c6cf47..b7bfa1db 100644
--- a/.github/workflows/sample-workflow.yml
+++ b/.github/workflows/sample-workflow.yml
@@ -20,22 +20,22 @@ jobs:
     steps:
       
       # Checkout your code repository to scan
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Run analyzers
     - name: Run Microsoft Security DevOps Analysis
-      uses: microsoft/security-devops-action@v1
+      uses: microsoft/security-devops-action@5b26a185ff02cf7c100778adeff0ebbf704ca144 # v1
       id: msdo
 
       # Upload alerts to the Security tab
     - name: Upload alerts to Security tab
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
       with:
         sarif_file: ${{ steps.msdo.outputs.sarifFile }}
 
       # Upload alerts file as a workflow artifact
     - name: Upload alerts file as a workflow artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:  
         name: alerts-${{ matrix.os }}
         path: ${{ steps.msdo.outputs.sarifFile }}
diff --git a/.github/workflows/self-hosted-validation-v1.yml b/.github/workflows/self-hosted-validation-v1.yml
index 3471076b..0a0af453 100644
--- a/.github/workflows/self-hosted-validation-v1.yml
+++ b/.github/workflows/self-hosted-validation-v1.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
 
       # Checkout your code repository to scan
-    - uses: actions/checkout@v6.0.2
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Run MSDO v1
     - name: Run MSDO
@@ -23,7 +23,7 @@ jobs:
 
       # Upload results to the Security tab
     - name: Upload results to Security tab
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
       if: always()
       with:
         sarif_file: ${{ steps.msdo.outputs.sarifFile }}