From 0a8581e6a150d7ec80f320bad9e326f3823a636b Mon Sep 17 00:00:00 2001 From: Carter Tinney Date: Mon, 31 Aug 2026 11:04:12 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs Copy the security hardening from #1247 onto an internal branch so it can run trusted CI. Co-authored-by: Dan Fiedler Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/issuelabeler.yml | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/issuelabeler.yml b/.github/workflows/issuelabeler.yml index ef848f7bf..b53db70b8 100644 --- a/.github/workflows/issuelabeler.yml +++ b/.github/workflows/issuelabeler.yml @@ -10,7 +10,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: Naturalclar/issue-action@v1.0.0 + - uses: Naturalclar/issue-action@596dfb92b8ba81449d4b3a0f34e9d3d279fab330 # v1.0.0 with: keywords: '[""]' labels: '["IoTSDK"]'