Pinned actions to specific SHAs

Author: jasonjoh

.github/dependabot.yml

@@ -9,7 +9,17 @@ updates:
     directory: "/user-auth/graphtutorial" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "npm"
     directory: "/app-auth/graphapponlytutorial" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "github-actions"
+    directory: "/" # Location of GitHub Actions workflows
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/auto-merge-dependabot.yml

@@ -3,7 +3,7 @@ name: Auto-merge dependabot updates
 on:
   pull_request:
     branches: [ main ]
-    
+
 permissions:
   pull-requests: write
   contents: write
@@ -13,16 +13,16 @@ jobs:
   dependabot-merge:
 
     runs-on: ubuntu-latest
-    
+
     if: ${{ github.actor == 'dependabot[bot]' }}
 
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.1.1
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
-      
+
       - name: Enable auto-merge for Dependabot PRs
         if: ${{steps.metadata.outputs.update-type != 'version-update:semver-major'}}
         run: gh pr merge --auto --merge "$PR_URL"

.github/workflows/nodejs.yml

@@ -17,15 +17,15 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [ 20.x, 22.x, 24.x ]
+        node-version: [ 22.x, 24.x ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Copy settings file
       run: |
         cp appSettings.example.js appSettings.js
     - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
     - name: Install dependencies
@@ -42,15 +42,15 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [ 20.x, 22.x, 24.x ]
+        node-version: [ 22.x, 24.x ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Copy settings file
       run: |
         cp appSettings.example.js appSettings.js
     - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
     - name: Install dependencies