From 6a75e4a6a05b332e3cbf0772a8f759da00547daf Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sun, 23 Aug 2026 12:25:24 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/build_net.yml | 4 ++-- .github/workflows/build_net_core.yml | 6 +++--- .github/workflows/feedback_service.yml | 6 +++--- .github/workflows/github_client.yml | 6 +++--- .github/workflows/repository_service.yml | 6 +++--- .github/workflows/vscode_client.yml | 6 +++--- 7 files changed, 28 insertions(+), 17 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2c48305 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build_net.yml b/.github/workflows/build_net.yml index 8918133..0b58072 100644 --- a/.github/workflows/build_net.yml +++ b/.github/workflows/build_net.yml @@ -16,11 +16,11 @@ jobs: runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET Core - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x diff --git a/.github/workflows/build_net_core.yml b/.github/workflows/build_net_core.yml index 52a827c..baac403 100644 --- a/.github/workflows/build_net_core.yml +++ b/.github/workflows/build_net_core.yml @@ -16,11 +16,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET Core - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x @@ -54,7 +54,7 @@ jobs: - name: Upload release artifacts if: github.ref == 'refs/heads/main' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: release path: release/* diff --git a/.github/workflows/feedback_service.yml b/.github/workflows/feedback_service.yml index d6bfe78..2f68c6d 100644 --- a/.github/workflows/feedback_service.yml +++ b/.github/workflows/feedback_service.yml @@ -11,11 +11,11 @@ jobs: runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET Core - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x - name: Install dependencies @@ -27,7 +27,7 @@ jobs: - name: dotnet publish run: dotnet publish src/PullRequestQuantifier.Feedback.Service/PullRequestQuantifier.Feedback.Service.csproj -c Release -o "${{env.DOTNET_ROOT}}/pullrequestquantifierfeedback" - name: Deploy to Azure Web App - uses: azure/webapps-deploy@v2 + uses: azure/webapps-deploy@5cfb776471c748b351e1ebf5770e208a54ace016 # v2.2.19 with: app-name: 'pullrequestquantifierfeedback' slot-name: 'production' diff --git a/.github/workflows/github_client.yml b/.github/workflows/github_client.yml index 485a993..3b83743 100644 --- a/.github/workflows/github_client.yml +++ b/.github/workflows/github_client.yml @@ -11,11 +11,11 @@ jobs: runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET Core - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x - name: Install dependencies @@ -28,7 +28,7 @@ jobs: run: dotnet publish src/Clients/PullRequestQuantifier.GitHub.Client/PullRequestQuantifier.GitHub.Client.csproj -c Release -o "${{env.DOTNET_ROOT}}/pullrequestquantifiergithubclient" - name: Deploy to Azure Web App if: github.ref == 'refs/heads/main' - uses: azure/webapps-deploy@v2 + uses: azure/webapps-deploy@5cfb776471c748b351e1ebf5770e208a54ace016 # v2.2.19 with: app-name: 'pullrequestquantifier' slot-name: 'production' diff --git a/.github/workflows/repository_service.yml b/.github/workflows/repository_service.yml index 130eb05..7b6d3de 100644 --- a/.github/workflows/repository_service.yml +++ b/.github/workflows/repository_service.yml @@ -11,11 +11,11 @@ jobs: runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET Core - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x - name: Install dependencies @@ -27,7 +27,7 @@ jobs: - name: dotnet publish run: dotnet publish src/PullRequestQuantifier.Repository.Service/PullRequestQuantifier.Repository.Service.csproj -c Release -o "${{env.DOTNET_ROOT}}/pullrequestquantifierreposervice" - name: Deploy to Azure Web App - uses: azure/webapps-deploy@v2 + uses: azure/webapps-deploy@5cfb776471c748b351e1ebf5770e208a54ace016 # v2.2.19 with: app-name: 'codevelocity-repositoryservice' slot-name: 'production' diff --git a/.github/workflows/vscode_client.yml b/.github/workflows/vscode_client.yml index da8088f..65341ad 100644 --- a/.github/workflows/vscode_client.yml +++ b/.github/workflows/vscode_client.yml @@ -12,11 +12,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET Core - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x - name: Install dependencies @@ -36,7 +36,7 @@ jobs: run: dotnet publish src/Clients/PullRequestQuantifier.VsCode.Client/PullRequestQuantifier.VsCode.Client.csproj --configuration Release --self-contained false -p:PackageVsix=true - name: Upload release artifacts if: github.ref == 'refs/heads/main' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: vsix path: src/Clients/PullRequestQuantifier.VsCode.Client/**/*.vsix