Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/aca-deploy.yaml

@@ -27,19 +27,19 @@ jobs:
         environment: ${{inputs.env-name}}
         steps:
         - name: Log in to Azure with service principal
-          uses: azure/login@v2
+          uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
           if: ${{ vars.AZURE_CLIENT_ID == '' }}
           with:
             creds: ${{ secrets.AZURE_CREDENTIALS }}
         - name: Log in with Azure (Federated Credentials)
           if: ${{ vars.AZURE_CLIENT_ID != '' }}
-          uses: azure/login@v2
+          uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
           with:
             client-id: ${{ vars.AZURE_CLIENT_ID }}
             tenant-id: ${{ vars.AZURE_TENANT_ID }}
             subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} 
         - name: Build and deploy Container App
-          uses: azure/container-apps-deploy-action@v1
+          uses: azure/container-apps-deploy-action@29ee19866ec987ededd70b8412d9ee241a9102d1 # v1
           with:
               acrName: ${{vars.ACR_NAME}}
               containerAppName: ${{inputs.container-app-name}}

.github/workflows/acr-build-push.yaml

@@ -26,27 +26,27 @@ jobs:
         steps:
         - name: Log in to Azure with service principal
           if: ${{ vars.AZURE_CLIENT_ID == '' }}
-          uses: azure/login@v2
+          uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
           with:
             creds: ${{ secrets.AZURE_CREDENTIALS }}
         - name: Log in Azure Container Registry
           if: ${{ vars.AZURE_CLIENT_ID == '' }}
-          uses: azure/docker-login@v2
+          uses: azure/docker-login@15c4aadf093404726ab2ff205b2cdd33fa6d054c # v2
           with:
             login-server: ${{vars.ACR_NAME}}.azurecr.io
             username: ${{ secrets.SPI_CLIENT_ID   }}
             password: ${{ secrets.SPI_CLIENT_SECRET }}
         - name: Log in with Azure (Federated Credentials)
           if: ${{ vars.AZURE_CLIENT_ID != '' }}
-          uses: azure/login@v2
+          uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
           with:
             client-id: ${{ vars.AZURE_CLIENT_ID }}
             tenant-id: ${{ vars.AZURE_TENANT_ID }}
             subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}       
         - name: Login to Azure Container Registry (Federated Credentials)
           if: ${{ vars.AZURE_CLIENT_ID != '' }}  
           run: az acr login --name ${{vars.ACR_NAME}}
-        - uses: actions/checkout@v2
+        - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
         - name: Build and Push to ACR
           run: |
             echo "Building image [${{ inputs.image-name }}] and environment [${{ inputs.env-name }}]"

.github/workflows/azure-dev.yaml

@@ -27,9 +27,9 @@ jobs:
       build-payment-api: ${{ steps.changes.outputs.payment-api }}
       build-transaction-api: ${{ steps.changes.outputs.transaction-api }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
       - name: Filter Changes
-        uses: dorny/paths-filter@v2
+        uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
         id: changes
         with:
             filters: |

.github/workflows/infra-ci.yaml

@@ -24,9 +24,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Filter Changes
-        uses: dorny/paths-filter@v2
+        uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
         id: changes
         with:
             filters: |
@@ -38,31 +38,31 @@ jobs:
                 - 'deploy/aca/**'
       - name: Build App Service Bicep for linting
         if: steps.changes.outputs.app-service == 'true'
-        uses: azure/CLI@v1
+        uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9
         with:
           inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f deploy/app-service/infra/main.bicep --stdout
 
       - name: Build AKS Bicep for linting
         if: steps.changes.outputs.aks == 'true'
-        uses: azure/CLI@v1
+        uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9
         with:
           inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f deploy/aks/infra/main.bicep --stdout
 
       - name: Build ACA Bicep for linting
         if: steps.changes.outputs.aca == 'true'
-        uses: azure/CLI@v1
+        uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9
         with:
           inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f deploy/aca/infra/main.bicep --stdout
 
       - name: Run Microsoft Security DevOps Analysis
-        uses: microsoft/security-devops-action@v1
+        uses: microsoft/security-devops-action@5b26a185ff02cf7c100778adeff0ebbf704ca144 # v1
         id: msdo
         continue-on-error: true
         with:
           tools: templateanalyzer
 
       - name: Upload alerts to Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
         if: github.repository == 'Azure-Samples/azure-search-openai-demo-java'
         with:
           sarif_file: ${{ steps.msdo.outputs.sarifFile }}