From 423766ccff49e84b199bd2776b497bb29e419b31 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 12:10:51 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/ci.js.yml | 4 ++-- .github/workflows/ci.python.yml | 8 ++++---- .github/workflows/fix-dependabot-alerts.yml | 12 ++++++------ .github/workflows/github-pages.yml | 8 ++++---- 5 files changed, 18 insertions(+), 16 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 43799bb7..9c2fa3c2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -74,3 +74,5 @@ updates: applies-to: security-updates patterns: ["*"] update-types: ["minor", "patch"] + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.js.yml b/.github/workflows/ci.js.yml index 4e1efb1b..5821ac43 100644 --- a/.github/workflows/ci.js.yml +++ b/.github/workflows/ci.js.yml @@ -30,9 +30,9 @@ jobs: # See supported Node.js release schedule at https://nodejs.org/en/about/releases/ steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node-version }} cache: "npm" diff --git a/.github/workflows/ci.python.yml b/.github/workflows/ci.python.yml index 8d3728dc..973bbd58 100644 --- a/.github/workflows/ci.python.yml +++ b/.github/workflows/ci.python.yml @@ -31,10 +31,10 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} @@ -58,7 +58,7 @@ jobs: echo "version=$PYRIGHT_VERSION" >> $GITHUB_OUTPUT - name: Run pyright ${{ steps.pyright-version.outputs.version }} - uses: jakebailey/pyright-action@v3 + uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3.0.2 with: version: ${{ steps.pyright-version.outputs.version }} python-version: ${{ matrix.python-version}} diff --git a/.github/workflows/fix-dependabot-alerts.yml b/.github/workflows/fix-dependabot-alerts.yml index ade460f4..3964d0a0 100644 --- a/.github/workflows/fix-dependabot-alerts.yml +++ b/.github/workflows/fix-dependabot-alerts.yml @@ -42,7 +42,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 # Don't leave the default GITHUB_TOKEN in .git/config — the @@ -51,7 +51,7 @@ jobs: # credentials reachable from build/test scripts. persist-credentials: false - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 cache: "npm" @@ -59,7 +59,7 @@ jobs: - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v1 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 with: app-id: ${{ vars.DEPENDABOT_APP_ID }} private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }} @@ -85,7 +85,7 @@ jobs: # so we save under a run-id-suffixed key and restore from the prefix. - name: Restore rollback state id: restore-state - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ${{ runner.temp }}/fix-dependabot-alerts-rollback-state.json key: fix-dep-rollback-state-v1-${{ github.run_id }} @@ -113,7 +113,7 @@ jobs: # be forgotten and the same broken upgrade re-tried tomorrow. - name: Save rollback state if: always() - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ${{ runner.temp }}/fix-dependabot-alerts-rollback-state.json # ``run_id`` is reused across job re-runs; include @@ -154,7 +154,7 @@ jobs: - name: Refresh app token if: ${{ steps.fix.outputs.changes == 'true' && steps.build.outputs.build_ok == 'true' }} id: app-token-pr - uses: actions/create-github-app-token@v1 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 with: app-id: ${{ vars.DEPENDABOT_APP_ID }} private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml index 7c43e256..179743d2 100644 --- a/.github/workflows/github-pages.yml +++ b/.github/workflows/github-pages.yml @@ -13,11 +13,11 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Use Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 18.x cache: 'npm' @@ -29,9 +29,9 @@ jobs: npm ci npm run build - name : Upload artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: name: github-pages path: site/_site - name: Deploy to GitHub Pages from artifacts - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0