From c885a8236412c7322101efe6787df1eb9345d51c Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 5 Sep 2026 17:57:18 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/aca-deploy.yaml | 6 +++--- .github/workflows/acr-build-push.yaml | 8 ++++---- .github/workflows/azure-dev.yaml | 4 ++-- .github/workflows/infra-ci.yaml | 14 +++++++------- 5 files changed, 27 insertions(+), 16 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/aca-deploy.yaml b/.github/workflows/aca-deploy.yaml index b0981c11..2b22911a 100644 --- a/.github/workflows/aca-deploy.yaml +++ b/.github/workflows/aca-deploy.yaml @@ -27,19 +27,19 @@ jobs: environment: ${{inputs.env-name}} steps: - name: Log in to Azure with service principal - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 if: ${{ vars.AZURE_CLIENT_ID == '' }} with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Log in with Azure (Federated Credentials) if: ${{ vars.AZURE_CLIENT_ID != '' }} - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - name: Build and deploy Container App - uses: azure/container-apps-deploy-action@v1 + uses: azure/container-apps-deploy-action@29ee19866ec987ededd70b8412d9ee241a9102d1 # v1 with: acrName: ${{vars.ACR_NAME}} containerAppName: ${{inputs.container-app-name}} diff --git a/.github/workflows/acr-build-push.yaml b/.github/workflows/acr-build-push.yaml index 930cdd33..553624a8 100644 --- a/.github/workflows/acr-build-push.yaml +++ b/.github/workflows/acr-build-push.yaml @@ -26,19 +26,19 @@ jobs: steps: - name: Log in to Azure with service principal if: ${{ vars.AZURE_CLIENT_ID == '' }} - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Log in Azure Container Registry if: ${{ vars.AZURE_CLIENT_ID == '' }} - uses: azure/docker-login@v2 + uses: azure/docker-login@15c4aadf093404726ab2ff205b2cdd33fa6d054c # v2 with: login-server: ${{vars.ACR_NAME}}.azurecr.io username: ${{ secrets.SPI_CLIENT_ID }} password: ${{ secrets.SPI_CLIENT_SECRET }} - name: Log in with Azure (Federated Credentials) if: ${{ vars.AZURE_CLIENT_ID != '' }} - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} @@ -46,7 +46,7 @@ jobs: - name: Login to Azure Container Registry (Federated Credentials) if: ${{ vars.AZURE_CLIENT_ID != '' }} run: az acr login --name ${{vars.ACR_NAME}} - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Build and Push to ACR run: | echo "Building image [${{ inputs.image-name }}] and environment [${{ inputs.env-name }}]" diff --git a/.github/workflows/azure-dev.yaml b/.github/workflows/azure-dev.yaml index 43686d49..2e4a916e 100644 --- a/.github/workflows/azure-dev.yaml +++ b/.github/workflows/azure-dev.yaml @@ -27,9 +27,9 @@ jobs: build-payment-api: ${{ steps.changes.outputs.payment-api }} build-transaction-api: ${{ steps.changes.outputs.transaction-api }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Filter Changes - uses: dorny/paths-filter@v2 + uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: changes with: filters: | diff --git a/.github/workflows/infra-ci.yaml b/.github/workflows/infra-ci.yaml index 68311c49..4f2fd2fa 100644 --- a/.github/workflows/infra-ci.yaml +++ b/.github/workflows/infra-ci.yaml @@ -24,9 +24,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Filter Changes - uses: dorny/paths-filter@v2 + uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: changes with: filters: | @@ -38,31 +38,31 @@ jobs: - 'deploy/aca/**' - name: Build App Service Bicep for linting if: steps.changes.outputs.app-service == 'true' - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f deploy/app-service/infra/main.bicep --stdout - name: Build AKS Bicep for linting if: steps.changes.outputs.aks == 'true' - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f deploy/aks/infra/main.bicep --stdout - name: Build ACA Bicep for linting if: steps.changes.outputs.aca == 'true' - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f deploy/aca/infra/main.bicep --stdout - name: Run Microsoft Security DevOps Analysis - uses: microsoft/security-devops-action@v1 + uses: microsoft/security-devops-action@5b26a185ff02cf7c100778adeff0ebbf704ca144 # v1 id: msdo continue-on-error: true with: tools: templateanalyzer - name: Upload alerts to Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 if: github.repository == 'Azure-Samples/azure-search-openai-demo-java' with: sarif_file: ${{ steps.msdo.outputs.sarifFile }}