From 873f0fa0d74e268b2ec91e85d229be24f3578841 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sun, 23 Aug 2026 12:46:22 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 4 +++- .github/workflows/analyze.yaml | 26 ++++++++++++------------ .github/workflows/build.yaml | 14 ++++++------- .github/workflows/dependencies.yaml | 2 +- .github/workflows/first-interaction.yaml | 2 +- .github/workflows/stale.yaml | 2 +- 6 files changed, 26 insertions(+), 24 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3b073c5..7da283b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,6 +16,8 @@ updates: - ci-quality reviewers: - microsoft/psrule-rules-github + cooldown: + default-days: 7 # Maintain dependencies for NuGet - package-ecosystem: nuget directory: '/' @@ -48,4 +50,4 @@ updates: - dependency-name: '*' update-types: - version-update:semver-major - - version-update:semver-minor + - version-update:semver-minor \ No newline at end of file diff --git a/.github/workflows/analyze.yaml b/.github/workflows/analyze.yaml index 3f2bc6f..146658c 100644 --- a/.github/workflows/analyze.yaml +++ b/.github/workflows/analyze.yaml @@ -34,10 +34,10 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Run PSRule analysis - uses: microsoft/ps-rule@v2.9.0 + uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0 with: modules: PSRule.Rules.MSFT.OSS prerelease: true @@ -45,13 +45,13 @@ jobs: outputPath: reports/ps-rule-results.sarif - name: Upload results to security tab - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 if: always() with: sarif_file: reports/ps-rule-results.sarif - name: Upload results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: PSRule-Sarif @@ -68,21 +68,21 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Run DevSkim scanner - uses: microsoft/DevSkim-Action@v1 + uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1.0.16 with: directory-to-scan: . - name: Upload results to security tab - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 if: always() with: sarif_file: devskim-results.sarif - name: Upload results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: DevSkim-Sarif @@ -99,22 +99,22 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 with: languages: 'csharp' - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 id: codeql-analyze - name: Upload results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: CodeQL-Sarif diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 036635d..5d7021e 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -30,10 +30,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.x @@ -55,7 +55,7 @@ jobs: Invoke-Build IntegrationTest -AssertStyle GitHubActions - name: Upload module - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: Module path: ./out/modules/PSRule.Rules.GitHub/* @@ -63,7 +63,7 @@ jobs: if-no-files-found: error - name: Upload PSRule Results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: Results-PSRule @@ -105,10 +105,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.x @@ -125,7 +125,7 @@ jobs: run: ./scripts/pipeline-deps.ps1 - name: Download module - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: Module path: ./out/modules/PSRule.Rules.GitHub diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml index 93ad7b5..a97e2e0 100644 --- a/.github/workflows/dependencies.yaml +++ b/.github/workflows/dependencies.yaml @@ -26,7 +26,7 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 diff --git a/.github/workflows/first-interaction.yaml b/.github/workflows/first-interaction.yaml index a1389fd..d7c66f9 100644 --- a/.github/workflows/first-interaction.yaml +++ b/.github/workflows/first-interaction.yaml @@ -20,7 +20,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/first-interaction@v1 + - uses: actions/first-interaction@3c71ce730280171fd1cfb57c00c774f8998586f7 # v1 with: repo-token: ${{ secrets.GITHUB_TOKEN }} issue-message: 'Thanks for raising your first issue, the team appreciates the time you have taken 😉' diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index d210141..7665c92 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -21,7 +21,7 @@ jobs: permissions: issues: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: stale-issue-message: > This issue has been automatically marked as stale because it has not had