From 89ecd1da12d2497c65a8f148a954870f74bfae55 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Fri, 10 Jul 2026 10:27:07 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/dts-e2e-tests.yaml | 4 ++-- .github/workflows/pr-validation.yaml | 10 +++++----- .github/workflows/prepare-release.yaml | 4 ++-- .github/workflows/validate-samples.yaml | 20 ++++++++++---------- 5 files changed, 30 insertions(+), 19 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2c48305 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/dts-e2e-tests.yaml b/.github/workflows/dts-e2e-tests.yaml index c2a383a..8029dcd 100644 --- a/.github/workflows/dts-e2e-tests.yaml +++ b/.github/workflows/dts-e2e-tests.yaml @@ -36,7 +36,7 @@ jobs: steps: - name: 📥 Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: 🐳 Pull Docker image run: docker pull mcr.microsoft.com/dts/dts-emulator:$EMULATOR_VERSION @@ -54,7 +54,7 @@ jobs: echo "ENDPOINT=localhost:8080" >> $GITHUB_ENV - name: ⚙️ NodeJS - Install - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/pr-validation.yaml b/.github/workflows/pr-validation.yaml index 191d01e..1b18a0b 100644 --- a/.github/workflows/pr-validation.yaml +++ b/.github/workflows/pr-validation.yaml @@ -20,10 +20,10 @@ jobs: steps: - name: 📥 Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: ⚙️ NodeJS - Install - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VER }} registry-url: "https://registry.npmjs.org" @@ -47,10 +47,10 @@ jobs: steps: - name: 📥 Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: ⚙️ NodeJS - Install - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} registry-url: "https://registry.npmjs.org" @@ -60,7 +60,7 @@ jobs: # Install Go SDK for durabletask-go sidecar - name: 🔧 Install Go SDK - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: "stable" diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml index bc05856..7a5fbb7 100644 --- a/.github/workflows/prepare-release.yaml +++ b/.github/workflows/prepare-release.yaml @@ -23,12 +23,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 # Full history needed for git diff and tags - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' diff --git a/.github/workflows/validate-samples.yaml b/.github/workflows/validate-samples.yaml index 8581562..851143a 100644 --- a/.github/workflows/validate-samples.yaml +++ b/.github/workflows/validate-samples.yaml @@ -36,7 +36,7 @@ jobs: emulator-samples: ${{ steps.find.outputs.emulator }} no-emulator-samples: ${{ steps.find.outputs.no_emulator }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: 🔍 Discover samples via sample.json id: find @@ -84,10 +84,10 @@ jobs: matrix: node-version: ["22.x"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: ⚙️ Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} cache: npm @@ -99,7 +99,7 @@ jobs: run: npm run build - name: 📁 Cache build output - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | node_modules @@ -120,15 +120,15 @@ jobs: sample: ${{ fromJson(needs.discover.outputs.no-emulator-samples) }} node-version: ["22.x"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: ⚙️ Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} - name: 📦 Restore build cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | node_modules @@ -169,7 +169,7 @@ jobs: DURABLE_TASK_SCHEDULER_CONNECTION_STRING: "Endpoint=http://localhost:8080;Authentication=None;TaskHub=default" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: 🐳 Start DTS emulator run: | @@ -190,12 +190,12 @@ jobs: run: sleep 10 - name: ⚙️ Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} - name: 📦 Restore build cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | node_modules