From 10aa0397d37483865af9da744d9bcae7678070a5 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 19 Aug 2026 10:49:26 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml              | 11 +++++++++++
 .github/workflows/markdownLint.yaml |  6 +++---
 .github/workflows/spellCheck.yaml   |  6 +++---
 3 files changed, 17 insertions(+), 6 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/markdownLint.yaml b/.github/workflows/markdownLint.yaml
index 2862dfbc..d671b1f9 100644
--- a/.github/workflows/markdownLint.yaml
+++ b/.github/workflows/markdownLint.yaml
@@ -22,14 +22,14 @@ jobs:
     name: Check Markdown linting
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
-    - uses: tj-actions/changed-files@v45
+    - uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.2
       id: changed-files
       with:
         files: '**/*.md'
-    - uses: DavidAnson/markdownlint-cli2-action@v17
+    - uses: DavidAnson/markdownlint-cli2-action@db43aef879112c3119a410d69f66701e0d530809 # v17.0.0
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         globs: ${{ steps.changed-files.outputs.all_changed_files }}
diff --git a/.github/workflows/spellCheck.yaml b/.github/workflows/spellCheck.yaml
index fc6ea646..3381b38c 100644
--- a/.github/workflows/spellCheck.yaml
+++ b/.github/workflows/spellCheck.yaml
@@ -67,7 +67,7 @@ jobs:
     steps:
       - name: check-spelling
         id: spelling
-        uses: check-spelling/check-spelling@v0.0.26
+        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
         with:
           suppress_push_for_open_pull_request: 1
           checkout: true
@@ -94,7 +94,7 @@ jobs:
     if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@v0.0.26
+        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
         with:
           checkout: true
           spell_check_this: check-spelling/spell-check-this@prerelease
@@ -110,7 +110,7 @@ jobs:
     if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@v0.0.26
+        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
         with:
           checkout: true
           spell_check_this: check-spelling/spell-check-this@prerelease