Update dependabot config and use SHAs/tags

[gewarren]

Contributes to #743

dotnet/runtime still uses tags for dotnet actions, so keeping those here for now too.

[Copilot]

🟡 Changes recommended

Critical local-action references would prevent Quest workflows from running, and multiple action references remain mutable or unpinned.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR updates GitHub Actions references and Dependabot configuration for safer automation.

Changes:

• Updates Quest, build-validation, CodeQL, and documentation workflows.
• Replaces selected action references with tags or commit SHAs.
• Groups GitHub Actions Dependabot updates and adds a seven-day cooldown.

File summaries

File	Review summary
.github/workflows/quest.yml	Critical: Invalid local-action paths and @main usage prevent OIDC and sequester actions from resolving.
.github/workflows/quest-bulk.yml	Critical: Invalid local-action paths and @main usage prevent workflow actions from resolving.
.github/workflows/node-build-validation.yml	Moderate: A mutable v7 action reference remains.
.github/workflows/dotnet-build-validation.yml	Moderate: Mutable v6 and v7 action references remain.
.github/workflows/codeql-analysis.yml	Moderate: Mutable v6 and v7 action references remain.
.github/workflows/build-docs-verifier.yml	Moderate: Mutable v6 and v7 action references remain.
.github/dependabot.yml	Moderate: Dependabot grouping does not address remaining unpinned dependabot/fetch-metadata@v3 and azure/login@v2 references.

Review details

Suppressed comments (5)

.github/dependabot.yml:8

• This new grouping only batches Dependabot updates; it does not make action references immutable. The PR requirement is to use full commit SHAs, but existing dependabot/fetch-metadata@v3 and azure/login@v2 references remain unpinned, so those action files also need to be updated or the PR scope clarified.

    groups:
      github-actions:
        patterns: ["*"]

.github/workflows/build-docs-verifier.yml:34

• The linked requirement is to pin actions to full commit SHAs, but this change introduces the mutable v7 tag. Pin this reference to the v7 commit so a tag move cannot change the workflow.

        uses: actions/upload-artifact@v7

.github/workflows/dotnet-build-validation.yml:57

• The linked requirement is to pin actions to full commit SHAs, but this change introduces the mutable v6 tag. Pin this reference to the v6 commit so a tag move cannot change the workflow.

      uses: actions/setup-dotnet@v6

.github/workflows/quest-bulk.yml:45

• This local action reference is invalid because $/.github/... is unsupported and local actions cannot use @main; the workflow will fail to load. Reference the checked-out action directly.

        uses: $/.github/actions/oidc-auth-flow@main

.github/workflows/quest.yml:51

• This local action reference is invalid because $/.github/... is not a supported path and local actions cannot use @main; the workflow will fail to load. Use the checked-out action path without a ref.

        uses: $/.github/actions/oidc-auth-flow@main

• Files reviewed: 7/7 changed files
• Comments generated: 13
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Invalid local action paths, missing checkout steps, mutable tags, and remaining unpinned action references must be fixed.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (16)

.github/workflows/build-docs-verifier.yml:13

• Please replace the mutable v7 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

      - uses: actions/checkout@v7

.github/workflows/build-docs-verifier.yml:17

• Please replace the mutable v6 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

        uses: actions/setup-dotnet@v6

.github/workflows/codeql-analysis.yml:29

• Please replace the mutable v7 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

      uses: actions/checkout@v7

.github/workflows/codeql-analysis.yml:42

• Please replace the mutable v6 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

      uses: actions/setup-dotnet@v6

.github/workflows/dotnet-build-validation.yml:26

• Please replace the mutable v7 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

    - uses: actions/checkout@v7

.github/workflows/dotnet-build-validation.yml:36

• Please replace the mutable v6 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

      uses: actions/setup-dotnet@v6

.github/workflows/dotnet-build-validation.yml:54

• Please replace the mutable v7 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

    - uses: actions/checkout@v7

.github/workflows/dotnet-build-validation.yml:57

• Please replace the mutable v6 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

      uses: actions/setup-dotnet@v6

.github/workflows/node-build-validation.yml:20

• Please replace the mutable v7 tag with its full commit SHA, as required by issue #743. A tag can be retargeted and does not provide the requested supply-chain pinning.

    - uses: actions/checkout@v7

.github/workflows/quest-bulk.yml:37

• This is not a valid repository-local action reference: $/.github/actions/oidc-auth-flow is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/oidc-auth-flow

.github/workflows/quest-bulk.yml:45

• This is not a valid repository-local action reference: $/.github/actions/oidc-auth-flow is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/oidc-auth-flow

.github/workflows/quest-bulk.yml:53

• This is not a valid repository-local action reference: $/.github/actions/sequester is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/sequester

.github/workflows/quest.yml:43

• This is not a valid repository-local action reference: $/.github/actions/oidc-auth-flow is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/oidc-auth-flow

.github/workflows/quest.yml:51

• This is not a valid repository-local action reference: $/.github/actions/oidc-auth-flow is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/oidc-auth-flow

.github/workflows/quest.yml:62

• This is not a valid repository-local action reference: $/.github/actions/sequester is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/sequester

.github/workflows/quest.yml:78

• This is not a valid repository-local action reference: $/.github/actions/sequester is neither the required ./... path nor a repository/ref, so the workflow will fail before this step runs. Use the repository-relative action path.

        uses: $/.github/actions/sequester

• Files reviewed: 7/7 changed files
• Comments generated: 4
• Review effort level: Lite

[meaghanlewis]

These changes LGTM