From 5048371c77f63623351b5852fb17cc993edb35ba Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 8 Sep 2026 15:48:39 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                     |  4 +++-
 .github/workflows/codeql.yml               |  8 ++++----
 .github/workflows/docs-examples.yml        | 18 +++++++++---------
 .github/workflows/hygiene.yml              |  2 +-
 .github/workflows/prompty-csharp-check.yml |  4 ++--
 .github/workflows/prompty-csharp.yml       |  6 +++---
 .github/workflows/prompty-java-check.yml   |  6 +++---
 .github/workflows/prompty-python-check.yml | 14 +++++++-------
 .github/workflows/prompty-python.yml       | 12 ++++++------
 .github/workflows/prompty-rust-check.yml   |  4 ++--
 .github/workflows/prompty-rust.yml         |  2 +-
 .github/workflows/prompty-swift-check.yml  |  6 +++---
 .github/workflows/prompty-ts-check.yml     |  4 ++--
 .github/workflows/prompty-ts-release.yml   |  4 ++--
 .github/workflows/prompty-vscode-check.yml |  4 ++--
 .github/workflows/prompty-vscode.yml       |  6 +++---
 .github/workflows/schema-repro-check.yml   | 10 +++++-----
 .github/workflows/web-deploy.yml           |  6 +++---
 18 files changed, 61 insertions(+), 59 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4b6eddc56..f36c39782 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -71,6 +71,8 @@ updates:
       actions-version:
         applies-to: version-updates
         patterns: ["*"]
+    cooldown:
+      default-days: 7
 
   # ---------------------------------------------------------------------------
   # v1 line (maintained release branch: v1)
@@ -109,4 +111,4 @@ updates:
     groups:
       pip-v1-version:
         applies-to: version-updates
-        patterns: ["*"]
+        patterns: ["*"]
\ No newline at end of file
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index baafecc92..3c4cc41cc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,18 +36,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
         if: matrix.language == 'csharp' || matrix.language == 'go' || matrix.language == 'rust'
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/docs-examples.yml b/.github/workflows/docs-examples.yml
index c1daa47b7..696445a9e 100644
--- a/.github/workflows/docs-examples.yml
+++ b/.github/workflows/docs-examples.yml
@@ -15,15 +15,15 @@ jobs:
     name: Python examples
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Install Python runtime
         working-directory: ./runtime/python/prompty
@@ -44,9 +44,9 @@ jobs:
       run:
         working-directory: web/docs-examples/typescript
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
@@ -64,10 +64,10 @@ jobs:
     name: C# examples
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup dotnet 9.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '9.0.x'
 
@@ -82,9 +82,9 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
diff --git a/.github/workflows/hygiene.yml b/.github/workflows/hygiene.yml
index 6c8f58682..8263405da 100644
--- a/.github/workflows/hygiene.yml
+++ b/.github/workflows/hygiene.yml
@@ -14,7 +14,7 @@ jobs:
     name: line endings and whitespace
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/prompty-csharp-check.yml b/.github/workflows/prompty-csharp-check.yml
index 335860f3e..319fbf650 100644
--- a/.github/workflows/prompty-csharp-check.yml
+++ b/.github/workflows/prompty-csharp-check.yml
@@ -19,9 +19,9 @@ jobs:
         dotnet-version: [ '9.0.x' ]
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup dotnet ${{ matrix.dotnet-version }}
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ matrix.dotnet-version }}
 
diff --git a/.github/workflows/prompty-csharp.yml b/.github/workflows/prompty-csharp.yml
index f5b24c336..1a983b663 100644
--- a/.github/workflows/prompty-csharp.yml
+++ b/.github/workflows/prompty-csharp.yml
@@ -22,9 +22,9 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '9.0.x'
 
@@ -49,7 +49,7 @@ jobs:
         run: dotnet pack --configuration Release --no-restore --output ./artifacts
 
       - name: NuGet login (OIDC trusted publishing)
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         id: nuget-login
         with:
           user: ${{ secrets.NUGET_USER }}
diff --git a/.github/workflows/prompty-java-check.yml b/.github/workflows/prompty-java-check.yml
index 503fc67ef..30e2e0013 100644
--- a/.github/workflows/prompty-java-check.yml
+++ b/.github/workflows/prompty-java-check.yml
@@ -22,16 +22,16 @@ jobs:
       run:
         working-directory: runtime/java
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Build and test (live tests excluded)
         run: ./gradlew build --console=plain
diff --git a/.github/workflows/prompty-python-check.yml b/.github/workflows/prompty-python-check.yml
index ca881e8fb..35a350e18 100644
--- a/.github/workflows/prompty-python-check.yml
+++ b/.github/workflows/prompty-python-check.yml
@@ -28,15 +28,15 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Install dependencies
         working-directory: ./runtime/python/prompty
@@ -60,7 +60,7 @@ jobs:
     needs: prompty-v2-tests
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create timestamp tag
         run: |
@@ -73,12 +73,12 @@ jobs:
           cat ./prompty/_version.py
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Install dependencies
         working-directory: ./runtime/python/prompty
@@ -91,7 +91,7 @@ jobs:
           flit build --format wheel
           flit build --format sdist
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: prompty-v2-artifacts
           path: ./runtime/python/prompty/dist/*
diff --git a/.github/workflows/prompty-python.yml b/.github/workflows/prompty-python.yml
index 069c519e8..64360bef8 100644
--- a/.github/workflows/prompty-python.yml
+++ b/.github/workflows/prompty-python.yml
@@ -14,15 +14,15 @@ jobs:
     name: release check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Install dependencies
         working-directory: ./runtime/python/prompty
@@ -51,7 +51,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify tag matches source version
         working-directory: ./runtime/python/prompty
@@ -66,12 +66,12 @@ jobs:
           echo "VERSION=$TAG_VERSION" >> "$GITHUB_ENV"
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Install dependencies
         working-directory: ./runtime/python/prompty
diff --git a/.github/workflows/prompty-rust-check.yml b/.github/workflows/prompty-rust-check.yml
index 3c9515954..82d4714b5 100644
--- a/.github/workflows/prompty-rust-check.yml
+++ b/.github/workflows/prompty-rust-check.yml
@@ -22,7 +22,7 @@ jobs:
       run:
         working-directory: runtime/rust
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -31,7 +31,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Cache cargo registry & build
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/prompty-rust.yml b/.github/workflows/prompty-rust.yml
index 25bbb878c..844be314d 100644
--- a/.github/workflows/prompty-rust.yml
+++ b/.github/workflows/prompty-rust.yml
@@ -24,7 +24,7 @@ jobs:
       run:
         working-directory: runtime/rust
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/prompty-swift-check.yml b/.github/workflows/prompty-swift-check.yml
index 9ed326167..0c3a772e2 100644
--- a/.github/workflows/prompty-swift-check.yml
+++ b/.github/workflows/prompty-swift-check.yml
@@ -19,12 +19,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Linux has no Xcode, so install a pinned standalone Swift toolchain.
       - name: Install Swift toolchain (Linux)
         if: runner.os == 'Linux'
-        uses: swift-actions/setup-swift@v2
+        uses: swift-actions/setup-swift@7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a # v2.4.0
         with:
           swift-version: '6.0'
 
@@ -35,7 +35,7 @@ jobs:
       # compiler and SDK stay in lockstep. See issue #474 (toolchain pinning).
       - name: Select Xcode (macOS)
         if: runner.os == 'macOS'
-        uses: maxim-lobanov/setup-xcode@v1
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
           xcode-version: latest-stable
 
diff --git a/.github/workflows/prompty-ts-check.yml b/.github/workflows/prompty-ts-check.yml
index 4a221bec0..03587d0a0 100644
--- a/.github/workflows/prompty-ts-check.yml
+++ b/.github/workflows/prompty-ts-check.yml
@@ -23,8 +23,8 @@ jobs:
       run:
         working-directory: runtime/typescript
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
       - run: npm ci
diff --git a/.github/workflows/prompty-ts-release.yml b/.github/workflows/prompty-ts-release.yml
index 9974051b4..5d83f2358 100644
--- a/.github/workflows/prompty-ts-release.yml
+++ b/.github/workflows/prompty-ts-release.yml
@@ -21,8 +21,8 @@ jobs:
       run:
         working-directory: runtime/typescript
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24  # Ships npm 11+ natively (OIDC trusted publishing)
           registry-url: https://registry.npmjs.org
diff --git a/.github/workflows/prompty-vscode-check.yml b/.github/workflows/prompty-vscode-check.yml
index fb2e998d6..5694dc3ec 100644
--- a/.github/workflows/prompty-vscode-check.yml
+++ b/.github/workflows/prompty-vscode-check.yml
@@ -22,10 +22,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
 
diff --git a/.github/workflows/prompty-vscode.yml b/.github/workflows/prompty-vscode.yml
index 5ec299e4b..58bc7f90b 100644
--- a/.github/workflows/prompty-vscode.yml
+++ b/.github/workflows/prompty-vscode.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
 
@@ -58,7 +58,7 @@ jobs:
         working-directory: ./vscode/prompty
         run: npm run package-pre -- "$VERSION" --no-update-package-json --out "prompty-${VSIX_TIMESTAMP}.vsix"
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: prompty-vsix-${{ env.VSIX_TIMESTAMP }}
           path: ./vscode/prompty/prompty-${{ env.VSIX_TIMESTAMP }}.vsix
diff --git a/.github/workflows/schema-repro-check.yml b/.github/workflows/schema-repro-check.yml
index 49bcf836b..3e5f394f6 100644
--- a/.github/workflows/schema-repro-check.yml
+++ b/.github/workflows/schema-repro-check.yml
@@ -79,7 +79,7 @@ jobs:
       # explicit lockfile error instead of a misattributed diff.
       UV_FROZEN: '1'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # EVERY toolchain below is pinned to an exact version, deliberately.
       # Path triggers can only catch formatter versions pinned by files in the repo.
@@ -101,7 +101,7 @@ jobs:
       # root (added deliberately, changing the toolchain for every Rust and C#
       # developer here), so `dotnet format` no longer needs the ephemeral global.json
       # this job used to write, and the action pins below simply mirror them.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22.23.2'
 
@@ -136,7 +136,7 @@ jobs:
           components: rustfmt
 
       - name: Set up Go (provides gofmt)
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           # Pinned via go.mod rather than a literal here: go.mod is the single source
           # of truth for the Go toolchain and is itself a trigger path above, so a
@@ -145,7 +145,7 @@ jobs:
           cache: false
 
       - name: Set up .NET (provides dotnet format)
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '9.0.317'
 
@@ -154,7 +154,7 @@ jobs:
         run: npm ci
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Install Python dev tooling (provides ruff)
         working-directory: runtime/python/prompty
diff --git a/.github/workflows/web-deploy.yml b/.github/workflows/web-deploy.yml
index 8863dff6b..1eca5646a 100644
--- a/.github/workflows/web-deploy.yml
+++ b/.github/workflows/web-deploy.yml
@@ -10,7 +10,7 @@ jobs:
   build-and-deploy-web:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Create tag
       run: |
         TAG="v$(TZ='America/Los_Angeles' date +%Y%m%d.%H%M%S)"
@@ -18,14 +18,14 @@ jobs:
         echo "Using tag: $TAG"
 
     - name: Log in to Azure
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID }}
         subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
     - name: Log in to registry
-      uses: docker/login-action@v4
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ${{ secrets.REGISTRY_ENDPOINT }}
         username: ${{ secrets.REGISTRY_USERNAME }}