From 2b49ce28ed43ee7f6f1bb53ff1b16873ce7ef07a Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 13:32:27 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs --- .github/actions/setup-go/action.yml | 2 +- .github/dependabot.yml | 2 ++ .github/workflows/ci.yml | 26 +++++++++++++------------- .github/workflows/codeql.yml | 14 +++++++------- .github/workflows/dependabot-tidy.yml | 2 +- 5 files changed, 24 insertions(+), 22 deletions(-) diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml index 48952dd630..c229c45c3b 100644 --- a/.github/actions/setup-go/action.yml +++ b/.github/actions/setup-go/action.yml @@ -32,7 +32,7 @@ runs: steps: - name: Install Go id: setup-go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ inputs.go-version }} check-latest: true diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 867d437af5..3cc0257d14 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -45,6 +45,8 @@ updates: # Keep the Windows base images (nanoserver/servercore) on their latest digest: scans # every Dockerfile (except vendored), bumps the digest only (tag kept), one grouped PR. + cooldown: + default-days: 7 - package-ecosystem: "docker" directories: - "/**/*" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac394e8d49..0a3e29268c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -43,7 +43,7 @@ jobs: cache: false - name: Run golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.11 args: >- @@ -69,7 +69,7 @@ jobs: # protobuild requires the code to be in $GOPATH to translate from github.com/Microsoft/hcsshim # to the correct path on disk - name: Checkout hcsshim - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: "${{ github.workspace }}/go/src/github.com/Microsoft/hcsshim" show-progress: false @@ -127,7 +127,7 @@ jobs: GOPROXY: "https://proxy.golang.org,direct" steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -192,7 +192,7 @@ jobs: runs-on: "windows-2022" steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -247,7 +247,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -285,7 +285,7 @@ jobs: runner: [self-hosted, 1ES.Pool=containerplat-github-runner-pool-east-us-2, 1ES.ImageOverride=github-mms-ws2022-containers-enabled] steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -420,7 +420,7 @@ jobs: run: ${{ env.GO_BUILD_CMD }} -mod=mod -o sample-logging-driver.exe ./cri-containerd/helpers/log.go working-directory: test - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ github.event_name == 'pull_request' }} with: name: test_binaries_${{ matrix.name }} @@ -441,7 +441,7 @@ jobs: steps: - name: Checkout hcsshim - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: src/github.com/Microsoft/hcsshim show-progress: false @@ -473,7 +473,7 @@ jobs: working-directory: src/github.com/Microsoft/hcsshim - name: Checkout containerd - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: src/github.com/containerd/containerd repository: "containerd/containerd" @@ -649,7 +649,7 @@ jobs: runs-on: "windows-2022" steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -723,7 +723,7 @@ jobs: - run: ${{ env.GO_BUILD_CMD }} ./internal/tools/zapdir name: Build zapdir.exe - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ github.event_name == 'pull_request' }} with: name: binaries @@ -748,7 +748,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 32a0d42dcf..4dc71fc968 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -82,7 +82,7 @@ jobs: # setup runner before initializing & running CodeQL - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: show-progress: false @@ -92,7 +92,7 @@ jobs: fill-module-cache: true - name: CodeQL Initialize - uses: github/codeql-action/init@v4.37.7 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: build-mode: manual languages: ${{matrix.language}} @@ -120,14 +120,14 @@ jobs: # only upload results if the analysis fails # otherwise, save the output and use `advanced-security/filter-sarif` to filter paths - name: CodeQL Analyze - uses: github/codeql-action/analyze@v4.37.7 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/language:${{matrix.language}}" output: sarif-results upload: failure-only - name: Filter Go SARIF Results - uses: advanced-security/filter-sarif@v1 + uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1 with: patterns: | +**/*.go @@ -138,7 +138,7 @@ jobs: output: sarif-results/go.sarif - name: Filter C/C++ SARIF Results - uses: advanced-security/filter-sarif@v1 + uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1 if: ${{ matrix.goos == 'linux' }} with: patterns: | @@ -148,12 +148,12 @@ jobs: output: sarif-results/cpp.sarif - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4.37.7 + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: sarif_file: sarif-results - name: Upload SARIF Results as Build Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sarif-results-${{ matrix.goos }} path: sarif-results diff --git a/.github/workflows/dependabot-tidy.yml b/.github/workflows/dependabot-tidy.yml index d4a755342a..7e63bbcc1c 100644 --- a/.github/workflows/dependabot-tidy.yml +++ b/.github/workflows/dependabot-tidy.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.head_ref }} show-progress: false From 76a7acd3611c6c00a6740c27e69b419ac3975fa3 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 19 Aug 2026 09:41:14 -0400 Subject: [PATCH 2/2] move cooldown config above comment block --- .github/dependabot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3cc0257d14..bfdce4f199 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -42,11 +42,11 @@ updates: schedule: interval: "daily" open-pull-requests-limit: 5 - - # Keep the Windows base images (nanoserver/servercore) on their latest digest: scans - # every Dockerfile (except vendored), bumps the digest only (tag kept), one grouped PR. cooldown: default-days: 7 + + # Keep the Windows base images (nanoserver/servercore) on their latest digest: scans + # every Dockerfile (except vendored), bumps the digest only (tag kept), one grouped PR. - package-ecosystem: "docker" directories: - "/**/*"