From e86956429e275d5f95c5179557e8d171028c5d7b Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Fri, 28 Aug 2026 18:03:44 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                            | 11 +++++++++++
 .github/workflows/ci.yml                          |  4 ++--
 .github/workflows/codeql.yml                      |  6 +++---
 .github/workflows/doc-freshness.lock.yml          |  2 +-
 .github/workflows/issue-go-clarify.lock.yml       |  2 +-
 .github/workflows/issue-go-no.yml                 |  4 ++--
 .github/workflows/issue-go-yes.lock.yml           |  4 ++--
 .github/workflows/issue-label-fixed-on-merge.yml  |  4 ++--
 .github/workflows/issue-labels-enforce-unique.yml |  4 ++--
 .github/workflows/issue-labels-migrate.yml        |  2 +-
 .github/workflows/issue-labels-sync.yml           |  6 +++---
 .github/workflows/issue-remove-stale.yml          |  4 ++--
 .github/workflows/issue-triage.lock.yml           |  2 +-
 .github/workflows/squad-heartbeat.yml             |  6 +++---
 .github/workflows/squad-release.yml               |  4 ++--
 .github/workflows/test-redact-secrets.yml         |  6 +++---
 .github/workflows/test-round-trip.yml             |  8 ++++----
 17 files changed, 45 insertions(+), 34 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f1f71cd..31f0c1db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,9 +20,9 @@ jobs:
         # engines) and the current Active LTS (24).
         node-version: ['22', '24']
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 604a5bb8..735682c9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -96,6 +96,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/doc-freshness.lock.yml b/.github/workflows/doc-freshness.lock.yml
index c8fa4475..8647554c 100644
--- a/.github/workflows/doc-freshness.lock.yml
+++ b/.github/workflows/doc-freshness.lock.yml
@@ -1103,7 +1103,7 @@ jobs:
         id: write-daily-aic-cache
         if: always()
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ github.token }}
           script: |
diff --git a/.github/workflows/issue-go-clarify.lock.yml b/.github/workflows/issue-go-clarify.lock.yml
index d980227b..aa5bc338 100644
--- a/.github/workflows/issue-go-clarify.lock.yml
+++ b/.github/workflows/issue-go-clarify.lock.yml
@@ -1094,7 +1094,7 @@ jobs:
         id: write-daily-aic-cache
         if: always()
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ github.token }}
           script: |
diff --git a/.github/workflows/issue-go-no.yml b/.github/workflows/issue-go-no.yml
index 233c1f13..811d99b5 100644
--- a/.github/workflows/issue-go-no.yml
+++ b/.github/workflows/issue-go-no.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Verify maintainer-triggered event
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const sender = context.payload.sender.login;
@@ -53,7 +53,7 @@ jobs:
             core.info(`Verified ${sender} as a ${permission.role_name || permission.permission} collaborator`);
 
       - name: Add close:wont-fix and close as not planned
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const issue_number = context.payload.issue.number;
diff --git a/.github/workflows/issue-go-yes.lock.yml b/.github/workflows/issue-go-yes.lock.yml
index dbf2dc9a..5a07a929 100644
--- a/.github/workflows/issue-go-yes.lock.yml
+++ b/.github/workflows/issue-go-yes.lock.yml
@@ -1139,7 +1139,7 @@ jobs:
         id: write-daily-aic-cache
         if: always()
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ github.token }}
           script: |
@@ -1549,7 +1549,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Verify assignee and squad labels
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GO_YES_SENDER: ${{ github.event.sender.login }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
diff --git a/.github/workflows/issue-label-fixed-on-merge.yml b/.github/workflows/issue-label-fixed-on-merge.yml
index 3904214d..9bdff0df 100644
--- a/.github/workflows/issue-label-fixed-on-merge.yml
+++ b/.github/workflows/issue-label-fixed-on-merge.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Verify close:fixed label exists
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const FIXED_LABEL = process.env.FIXED_LABEL;
@@ -62,7 +62,7 @@ jobs:
             }
 
       - name: Apply close:fixed to auto-closed issues
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const FIXED_LABEL = process.env.FIXED_LABEL;
diff --git a/.github/workflows/issue-labels-enforce-unique.yml b/.github/workflows/issue-labels-enforce-unique.yml
index 096ba965..004ce05e 100644
--- a/.github/workflows/issue-labels-enforce-unique.yml
+++ b/.github/workflows/issue-labels-enforce-unique.yml
@@ -12,10 +12,10 @@ jobs:
   enforce:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Enforce one label per category
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/issue-labels-migrate.yml b/.github/workflows/issue-labels-migrate.yml
index bd4e4e4e..e07744b0 100644
--- a/.github/workflows/issue-labels-migrate.yml
+++ b/.github/workflows/issue-labels-migrate.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Rename legacy labels to type: equivalents"
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             // Legacy label → canonical type: label.
diff --git a/.github/workflows/issue-labels-sync.yml b/.github/workflows/issue-labels-sync.yml
index 335e493c..887cfb38 100644
--- a/.github/workflows/issue-labels-sync.yml
+++ b/.github/workflows/issue-labels-sync.yml
@@ -19,10 +19,10 @@ jobs:
   sync-labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -35,7 +35,7 @@ jobs:
         run: npm ci --omit=dev --ignore-scripts
 
       - name: Parse roster and sync labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/issue-remove-stale.yml b/.github/workflows/issue-remove-stale.yml
index b2d6faea..7de7ba9c 100644
--- a/.github/workflows/issue-remove-stale.yml
+++ b/.github/workflows/issue-remove-stale.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Warn stale issues
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             // Layer 2 — code guard: these labels make an issue untouchable regardless of
@@ -143,7 +143,7 @@ jobs:
 
     steps:
       - name: Close warned stale issues
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             // Layer 2 — code guard.
diff --git a/.github/workflows/issue-triage.lock.yml b/.github/workflows/issue-triage.lock.yml
index ce7ca6d3..9d4e7b0f 100644
--- a/.github/workflows/issue-triage.lock.yml
+++ b/.github/workflows/issue-triage.lock.yml
@@ -1101,7 +1101,7 @@ jobs:
         id: write-daily-aic-cache
         if: always()
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ github.token }}
           script: |
diff --git a/.github/workflows/squad-heartbeat.yml b/.github/workflows/squad-heartbeat.yml
index 609cb51e..297f0693 100644
--- a/.github/workflows/squad-heartbeat.yml
+++ b/.github/workflows/squad-heartbeat.yml
@@ -25,7 +25,7 @@ jobs:
   heartbeat:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Check triage script
         id: check-script
@@ -48,7 +48,7 @@ jobs:
 
       - name: Ralph — Apply triage decisions
         if: steps.check-script.outputs.has_script == 'true' && hashFiles('triage-results.json') != ''
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const fs = require('fs');
@@ -100,7 +100,7 @@ jobs:
       # Copilot auto-assign step (uses PAT if available)
       - name: Ralph — Assign @copilot issues
         if: success()
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/squad-release.yml b/.github/workflows/squad-release.yml
index d9271919..8d8c062a 100644
--- a/.github/workflows/squad-release.yml
+++ b/.github/workflows/squad-release.yml
@@ -11,11 +11,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
 
diff --git a/.github/workflows/test-redact-secrets.yml b/.github/workflows/test-redact-secrets.yml
index beb15be7..611b8fe0 100644
--- a/.github/workflows/test-redact-secrets.yml
+++ b/.github/workflows/test-redact-secrets.yml
@@ -70,9 +70,9 @@ jobs:
     environment: integration-test
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -92,7 +92,7 @@ jobs:
           fi
 
       - name: Azure Login
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/test-round-trip.yml b/.github/workflows/test-round-trip.yml
index 4027ec46..8221cf44 100644
--- a/.github/workflows/test-round-trip.yml
+++ b/.github/workflows/test-round-trip.yml
@@ -96,9 +96,9 @@ jobs:
     environment: integration-test # Requires approval for cost protection
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -118,7 +118,7 @@ jobs:
           fi
 
       - name: Azure Login
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -155,7 +155,7 @@ jobs:
 
       - name: Azure Login - Refresh Before Phase 2
         if: success()
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           # Phase 1 can run for a long time while APIM activates; refresh login
           # before extract/publish so apiops receives a fresh federated session.