From c034e7985f08fc3b001f2ba3f66c59895838ae24 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 16:01:13 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .../Scheduled-Dependabot-PRs-Auto-Merge.yml | 2 +- .github/workflows/azd-template-validation.yml | 4 ++-- .github/workflows/azure-dev.yml | 6 +++--- .github/workflows/bicep_deploy.yml | 4 ++-- .github/workflows/broken-links-checker.yml | 6 +++--- .github/workflows/codeql.yml | 10 +++++----- .github/workflows/deploy-KMGeneric.yml | 6 +++--- .github/workflows/deploy.yml | 6 +++--- .github/workflows/docker-build.yml | 10 +++++----- .github/workflows/job-azure-deploy.yml | 4 ++-- .github/workflows/job-cleanup-resources.yml | 2 +- .github/workflows/job-deploy-linux.yml | 14 +++++++------- .github/workflows/job-deploy-windows.yml | 14 +++++++------- .github/workflows/job-docker-build.yml | 10 +++++----- .github/workflows/job-test-automation.yml | 6 +++--- .github/workflows/pr-title-checker.yml | 2 +- .github/workflows/pylint.yml | 4 ++-- .github/workflows/stale-bot.yml | 6 +++--- .github/workflows/telemetry-template-check.yml | 2 +- .github/workflows/test-automation.yml | 6 +++--- .github/workflows/test.yml | 4 ++-- .github/workflows/validate-bicep-params.yml | 6 +++--- 23 files changed, 69 insertions(+), 67 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f69199b33..d0b32d6d3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,6 +16,8 @@ updates: - "*" # Python backend dependencies - grouped + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "/src/api" schedule: diff --git a/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml b/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml index baa7d42a1..81a60310c 100644 --- a/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml +++ b/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install GitHub CLI run: | diff --git a/.github/workflows/azd-template-validation.yml b/.github/workflows/azd-template-validation.yml index 2e2c752fb..35f426a4f 100644 --- a/.github/workflows/azd-template-validation.yml +++ b/.github/workflows/azd-template-validation.yml @@ -15,12 +15,12 @@ jobs: name: azd template validation environment: production steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set timestamp run: echo "HHMM=$(date -u +'%H%M')" >> $GITHUB_ENV - - uses: microsoft/template-validation-action@v0.4.3 + - uses: microsoft/template-validation-action@9f56864b1ddbfb56dd27f3cbc71a00750cdb9a18 # v0.4.3 with: validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }} validateTests: ${{ vars.TEMPLATE_VALIDATE_TESTS }} diff --git a/.github/workflows/azure-dev.yml b/.github/workflows/azure-dev.yml index 31480f6a6..6e7d550fb 100644 --- a/.github/workflows/azure-dev.yml +++ b/.github/workflows/azure-dev.yml @@ -21,7 +21,7 @@ jobs: AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }} steps: - name: Checkout Code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set timestamp and env name run: | @@ -29,10 +29,10 @@ jobs: echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@634ad924cf8baef2257898ba5663be8d19f15aca # v2.3.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/bicep_deploy.yml b/.github/workflows/bicep_deploy.yml index eefbf4cff..9cf6ce3a8 100644 --- a/.github/workflows/bicep_deploy.yml +++ b/.github/workflows/bicep_deploy.yml @@ -19,10 +19,10 @@ jobs: environment: production steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml index 3b19db1df..4729928e1 100644 --- a/.github/workflows/broken-links-checker.yml +++ b/.github/workflows/broken-links-checker.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 @@ -35,7 +35,7 @@ jobs: - name: Check Broken Links in Changed Markdown Files id: lychee-check-pr if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true' - uses: lycheeverse/lychee-action@v2.7.0 + uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0 with: args: > --verbose --no-progress --exclude ^https?:// @@ -48,7 +48,7 @@ jobs: - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger) id: lychee-check-manual if: github.event_name == 'workflow_dispatch' - uses: lycheeverse/lychee-action@v2.7.0 + uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0 with: args: > --verbose --no-progress --exclude ^https?:// diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 32ed2cf07..1b93fdc55 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -53,12 +53,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 # Installing DotNet version - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Setup dotnet ${{ matrix.dotnet-version }} - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: ${{ matrix.dotnet-version }} # You can test your matrix by printing the current dotnet version @@ -67,7 +67,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -94,6 +94,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/deploy-KMGeneric.yml b/.github/workflows/deploy-KMGeneric.yml index 8c6684004..ae4f91c63 100644 --- a/.github/workflows/deploy-KMGeneric.yml +++ b/.github/workflows/deploy-KMGeneric.yml @@ -32,10 +32,10 @@ jobs: API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -218,7 +218,7 @@ jobs: RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }} steps: - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 365ec8ae1..12fa8b20d 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -20,10 +20,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.x' @@ -38,7 +38,7 @@ jobs: touch site/.nojekyll # Disable Jekyll processing - name: Deploy to GitHub Pages - uses: peaceiris/actions-gh-pages@v4 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: docs/workshop/site diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 15f4367f5..cd3c0efad 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -46,14 +46,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Login to Azure if: ${{ (github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) || (github.event_name == 'workflow_dispatch' && (github.ref_name == 'dependabotchanges'||github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) }} - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -89,7 +89,7 @@ jobs: fi - name: Build and Push Docker Image for WebApp - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./src/App file: ./src/App/WebApp.Dockerfile @@ -99,7 +99,7 @@ jobs: ${{ secrets.ACR_LOGIN_SERVER || 'acrlogin.azurecr.io' }}/km-app:${{ steps.determine_tag.outputs.tagname }}_${{ steps.date.outputs.date }}_${{ github.run_number }} - name: Build and Push Docker Image for api - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./src/api file: ./src/api/ApiApp.Dockerfile diff --git a/.github/workflows/job-azure-deploy.yml b/.github/workflows/job-azure-deploy.yml index b71b7e245..5dcdd410a 100644 --- a/.github/workflows/job-azure-deploy.yml +++ b/.github/workflows/job-azure-deploy.yml @@ -329,10 +329,10 @@ jobs: echo "Final EXP status: $EXP_ENABLED" - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-cleanup-resources.yml b/.github/workflows/job-cleanup-resources.yml index 83a60a576..843f4a6f8 100644 --- a/.github/workflows/job-cleanup-resources.yml +++ b/.github/workflows/job-cleanup-resources.yml @@ -55,7 +55,7 @@ jobs: IMAGE_TAG: ${{ inputs.image_tag }} steps: - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-linux.yml b/.github/workflows/job-deploy-linux.yml index 3ece58123..8feb50409 100644 --- a/.github/workflows/job-deploy-linux.yml +++ b/.github/workflows/job-deploy-linux.yml @@ -206,7 +206,7 @@ jobs: echo "✅ All input parameters validated successfully!" - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Configure Parameters Based on WAF Setting shell: bash @@ -237,10 +237,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@634ad924cf8baef2257898ba5663be8d19f15aca # v2.3.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -354,7 +354,7 @@ jobs: echo "✅ ODBC Driver 18 for SQL Server installed successfully." - name: Re-authenticate with Azure (refresh OIDC token) - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -371,7 +371,7 @@ jobs: - name: Re-authenticate with Azure before retry (refresh OIDC token) if: steps.run_create_agents_scripts.outcome == 'failure' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -387,7 +387,7 @@ jobs: echo "✅ Create agents scripts completed successfully on retry." - name: Re-authenticate with Azure before processing sample data (refresh OIDC token) - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -404,7 +404,7 @@ jobs: - name: Re-authenticate with Azure before retry (refresh OIDC token) if: steps.process_sample_data.outcome == 'failure' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-windows.yml b/.github/workflows/job-deploy-windows.yml index e63c84851..0a3a8025e 100644 --- a/.github/workflows/job-deploy-windows.yml +++ b/.github/workflows/job-deploy-windows.yml @@ -209,7 +209,7 @@ jobs: echo "✅ All input parameters validated successfully!" - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Configure Parameters Based on WAF Setting shell: bash @@ -240,10 +240,10 @@ jobs: fi - name: Setup Azure Developer CLI (Windows) - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@634ad924cf8baef2257898ba5663be8d19f15aca # v2.3.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -379,7 +379,7 @@ jobs: } - name: Re-authenticate with Azure (refresh OIDC token) - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -398,7 +398,7 @@ jobs: - name: Re-authenticate with Azure before retry (refresh OIDC token) if: steps.run_create_agents_scripts.outcome == 'failure' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -416,7 +416,7 @@ jobs: echo "✅ Create agents scripts completed successfully on retry." - name: Re-authenticate with Azure before processing sample data (refresh OIDC token) - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -435,7 +435,7 @@ jobs: - name: Re-authenticate with Azure before retry (refresh OIDC token) if: steps.process_sample_data.outcome == 'failure' - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-docker-build.yml b/.github/workflows/job-docker-build.yml index 1ee14faad..4001863c6 100644 --- a/.github/workflows/job-docker-build.yml +++ b/.github/workflows/job-docker-build.yml @@ -29,7 +29,7 @@ jobs: IMAGE_TAG: ${{ steps.generate_docker_tag.outputs.IMAGE_TAG }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Generate Unique Docker Image Tag id: generate_docker_tag @@ -46,10 +46,10 @@ jobs: echo "Generated unique Docker tag: $UNIQUE_TAG" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Login to Azure - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -61,7 +61,7 @@ jobs: az acr login --name "$ACR_NAME" - name: Build and Push Docker Image for WebApp - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 env: DOCKER_BUILD_SUMMARY: false with: @@ -73,7 +73,7 @@ jobs: ${{ secrets.ACR_TEST_LOGIN_SERVER }}/km-app:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }} - name: Build and Push Docker Image for API - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 env: DOCKER_BUILD_SUMMARY: false with: diff --git a/.github/workflows/job-test-automation.yml b/.github/workflows/job-test-automation.yml index 9db1db98d..78978220c 100644 --- a/.github/workflows/job-test-automation.yml +++ b/.github/workflows/job-test-automation.yml @@ -48,10 +48,10 @@ jobs: TEST_REPORT_URL: ${{ steps.upload_report.outputs.artifact-url }} steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.13' @@ -193,7 +193,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 if: ${{ !cancelled() }} with: diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml index 67ba788b2..b6e0ebbaa 100644 --- a/.github/workflows/pr-title-checker.yml +++ b/.github/workflows/pr-title-checker.yml @@ -19,6 +19,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'merge_group' }} steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml index d14a7c343..85b40f8b7 100644 --- a/.github/workflows/pylint.yml +++ b/.github/workflows/pylint.yml @@ -19,10 +19,10 @@ jobs: matrix: python-version: ["3.11"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml index 85c76e855..a5077bed0 100644 --- a/.github/workflows/stale-bot.yml +++ b/.github/workflows/stale-bot.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Mark Stale Issues and PRs - uses: actions/stale@v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 with: stale-issue-message: "This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or it will be closed in 30 days." stale-pr-message: "This PR is stale because it has been open 180 days with no activity. Please update or it will be closed in 30 days." @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 # Fetch full history for accurate branch checks - name: Fetch All Branches @@ -75,7 +75,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload CSV Report of Inactive Branches - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: merged-branches-report path: merged_branches_report.csv diff --git a/.github/workflows/telemetry-template-check.yml b/.github/workflows/telemetry-template-check.yml index cf020bbdc..1b2b86c03 100644 --- a/.github/workflows/telemetry-template-check.yml +++ b/.github/workflows/telemetry-template-check.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Check for required metadata template line run: | diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml index ac571cf51..947745c24 100644 --- a/.github/workflows/test-automation.yml +++ b/.github/workflows/test-automation.yml @@ -40,10 +40,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.13' @@ -123,7 +123,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 if: ${{ !cancelled() }} with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a45f09f72..d1978cc15 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -79,10 +79,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" diff --git a/.github/workflows/validate-bicep-params.yml b/.github/workflows/validate-bicep-params.yml index c53caead3..231b8c96c 100644 --- a/.github/workflows/validate-bicep-params.yml +++ b/.github/workflows/validate-bicep-params.yml @@ -24,10 +24,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11' @@ -63,7 +63,7 @@ jobs: - name: Upload validation results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: bicep-validation-results path: |