From 25c7f79b78304bb85eafc72d6390b89ebbd8e83d Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 16 Sep 2026 10:11:28 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 4 +++- .github/workflows/check-casing-changes.yml | 4 ++-- .github/workflows/metadata-parser-validation.yml | 10 +++++----- .github/workflows/openapi-parser-validation.yml | 8 ++++---- .github/workflows/validate-typespec-changes.yml | 6 +++--- 5 files changed, 17 insertions(+), 15 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c4e9a9970..4450563bc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,9 +5,11 @@ updates: schedule: interval: daily open-pull-requests-limit: 10 + cooldown: + default-days: 7 - package-ecosystem: npm directory: "/additions" schedule: interval: daily - open-pull-requests-limit: 10 + open-pull-requests-limit: 10 \ No newline at end of file diff --git a/.github/workflows/check-casing-changes.yml b/.github/workflows/check-casing-changes.yml index 4bd7b4c73..83e6a2606 100644 --- a/.github/workflows/check-casing-changes.yml +++ b/.github/workflows/check-casing-changes.yml @@ -23,7 +23,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -51,7 +51,7 @@ jobs: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Regenerate type mapping baselines shell: pwsh diff --git a/.github/workflows/metadata-parser-validation.yml b/.github/workflows/metadata-parser-validation.yml index 941b638f2..522bf711a 100644 --- a/.github/workflows/metadata-parser-validation.yml +++ b/.github/workflows/metadata-parser-validation.yml @@ -12,7 +12,7 @@ jobs: outputs: matrix: ${{ steps.set-conversion-settings.outputs.matrix }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: set-conversion-settings run: echo "matrix=$(ls conversion-settings/*.json | sed 's/.*\///' | sed 's/\.[^.]*$//' | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT @@ -27,12 +27,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive - name: Setup .NET - uses: actions/setup-dotnet@v6.0.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 9.x @@ -44,11 +44,11 @@ jobs: shell: pwsh - name: Validate description with redocly - uses: fluximus-prime/redocly-cli-github-action@v1 + uses: fluximus-prime/redocly-cli-github-action@db9f109674644db10fa51723b7eb83938ed24f7d # v1 with: args: 'lint transformed_${{ matrix.version }}_${{ matrix.settings }}_metadata.yml --skip-rule operation-4xx-response --skip-rule no-server-trailing-slash --skip-rule no-unused-components --skip-rule security-defined --skip-rule info-license-url --skip-rule info-license --skip-rule no-empty-servers --skip-rule operation-summary --skip-rule tag-description --max-problems 1000' - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: ${{ matrix.version }}-${{ matrix.settings }} diff --git a/.github/workflows/openapi-parser-validation.yml b/.github/workflows/openapi-parser-validation.yml index 53ddaf808..d984bd0f1 100644 --- a/.github/workflows/openapi-parser-validation.yml +++ b/.github/workflows/openapi-parser-validation.yml @@ -13,7 +13,7 @@ jobs: outputs: matrix: ${{ steps.set-conversion-settings.outputs.matrix }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: set-conversion-settings run: echo "matrix=$(ls conversion-settings/*.json | sed 's/.*\///' | sed 's/\.[^.]*$//' | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT @@ -28,11 +28,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive - name: Setup .NET - uses: actions/setup-dotnet@v6.0.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 9.x @@ -44,6 +44,6 @@ jobs: shell: pwsh - name: Validate description with redocly - uses: fluximus-prime/redocly-cli-github-action@v1 + uses: fluximus-prime/redocly-cli-github-action@db9f109674644db10fa51723b7eb83938ed24f7d # v1 with: args: 'lint openapi/${{ matrix.version }}/${{ matrix.settings }}.yaml --skip-rule operation-4xx-response --skip-rule no-server-trailing-slash --skip-rule no-unused-components --skip-rule security-defined --skip-rule info-license-url --skip-rule info-license --skip-rule no-empty-servers --skip-rule operation-summary --skip-rule tag-description --max-problems 1000' diff --git a/.github/workflows/validate-typespec-changes.yml b/.github/workflows/validate-typespec-changes.yml index e742305bf..e4bce5567 100644 --- a/.github/workflows/validate-typespec-changes.yml +++ b/.github/workflows/validate-typespec-changes.yml @@ -13,10 +13,10 @@ jobs: run: working-directory: additions steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup NodeJs - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '22.x' @@ -29,7 +29,7 @@ jobs: - name: build typespec run: tsp compile . - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: CSDLs