Pin GitHub Actions to full-length commit SHAs

[Bryan DeYoung (brdeyo)]

Please review and merge action-pinning pull requests to your public GitHub repositories. One or more of your repositories recently received a pull request from danfiedler-msft that pins GitHub actions to full commit SHAs and adds a 7-day cooldown Dependabot configuration for GitHub Actions.

Action Requested: Review and Merge Pull Requests
Please review and merge the following PRs:

microsoft/VirtualClient PR #790: https://github.com/microsoft/VirtualClient/pull/790
You’re receiving this email because you’re listed as an owner of the above GitHub repository or repositories (according to open source management data).

Rationale
Workflows that reference Actions using mutable tags like Jaimy de Graaf (@v4), Vlad Vannov (@main), or latest are vulnerable to supply chain attacks. If an Action maintainer's account or release process is compromised, an attacker can move a tag to malicious code; causing every dependent workflow to execute the attacker's payload without any change in your repository.

Microsoft will soon require that all GitHub Actions be referenced using a commit SHA (“pinned”) rather than a mutable tag. You can read the full announcement at https://aka.ms/pinning-requirement

The previously mentioned pull requests are intended to help defend against supply chain attacks and keep your GitHub Actions Workflows working under the new policy. You can read more about this campaign at https://aka.ms/action-pinning

Other Options
If you choose not to merge the above PR and prefer to modify your own workflows, high-level guidance on action pinning is available at https://aka.ms/pinning-tsg

Additional information on securing your use of GitHub Actions is available at Secure use reference - GitHub Docs and https://aka.ms/secure-actions.

Thanks,

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.