From 902eda05e7dc9ce59d26fdfe7515fed13f8fc017 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 18 Aug 2026 12:08:14 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                          | 9 +++++++++
 .github/workflows/build-test-lint.yml           | 8 ++++----
 .github/workflows/codeql.yml                    | 6 +++---
 .github/workflows/copilot-attestation-check.yml | 2 +-
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f33a02cd1..ed2148072 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,12 @@ updates:
    directory: "/"
    schedule:
      interval: weekly
+ - package-ecosystem: "github-actions"
+   directory: "/"
+   groups:
+     github-actions:
+       patterns: ["*"]
+   schedule:
+     interval: "weekly"
+   cooldown:
+     default-days: 7
diff --git a/.github/workflows/build-test-lint.yml b/.github/workflows/build-test-lint.yml
index 77b1ecd11..485a98962 100644
--- a/.github/workflows/build-test-lint.yml
+++ b/.github/workflows/build-test-lint.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
       - name: Detect code changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
         id: changes
         with:
           filters: |
@@ -37,7 +37,7 @@ jobs:
 
       - name: Setup .NET
         if: steps.changes.outputs.code == 'true'
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
           dotnet-version: '10.0.x'
 
@@ -59,7 +59,7 @@ jobs:
 
       - name: Upload nupkg as workflow artifact
         if: steps.changes.outputs.code == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: nupkg
           path: ./nupkgs/*.nupkg
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0f65ec9a3..1c51eae44 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -96,6 +96,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/copilot-attestation-check.yml b/.github/workflows/copilot-attestation-check.yml
index ada715989..1e96f7654 100644
--- a/.github/workflows/copilot-attestation-check.yml
+++ b/.github/workflows/copilot-attestation-check.yml
@@ -24,7 +24,7 @@ jobs:
       (github.event_name == 'pull_request_review_comment')
     steps:
       - name: Check for attestation comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             // Handle both pull_request and issue_comment events