From 32e94f76e16ff9d529c1b4c9d62f6eab04296df0 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 12:02:21 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/publish-emitter.yml | 10 +++++----- .github/workflows/publish-go.yml | 6 +++--- .github/workflows/publish-npm.yml | 10 +++++----- .github/workflows/publish-nuget.yml | 8 ++++---- .github/workflows/publish-pypi.yml | 12 ++++++------ .github/workflows/publish-rust.yml | 8 ++++---- .github/workflows/publish-web.yml | 6 +++--- .github/workflows/test-rust.yml | 2 +- 9 files changed, 42 insertions(+), 31 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/publish-emitter.yml b/.github/workflows/publish-emitter.yml index 6c8c9512..24a5b27d 100644 --- a/.github/workflows/publish-emitter.yml +++ b/.github/workflows/publish-emitter.yml @@ -23,12 +23,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: "https://registry.npmjs.org" @@ -46,7 +46,7 @@ jobs: run: npm run lint - name: Store build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: emitter-package-build path: | @@ -65,12 +65,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-go.yml b/.github/workflows/publish-go.yml index 5dabccbc..d4e700b6 100644 --- a/.github/workflows/publish-go.yml +++ b/.github/workflows/publish-go.yml @@ -27,10 +27,10 @@ jobs: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ env.GO_VERSION }} @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 92d9d00a..47874e1e 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -23,12 +23,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: "https://registry.npmjs.org" @@ -46,7 +46,7 @@ jobs: run: npm test - name: Store build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: npm-package-build path: | @@ -64,12 +64,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml index 557e9b65..e0f3473d 100644 --- a/.github/workflows/publish-nuget.yml +++ b/.github/workflows/publish-nuget.yml @@ -21,12 +21,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: ${{ env.DOTNET_VERSION }} @@ -46,12 +46,12 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: ${{ env.DOTNET_VERSION }} diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 247ba263..09d4256b 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -21,10 +21,10 @@ jobs: (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/python-v')) steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 with: version: "latest" @@ -49,10 +49,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 with: version: "latest" @@ -73,7 +73,7 @@ jobs: run: uv build - name: Store distribution packages - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: python-package-distributions path: runtime/python/agentschema/dist/ @@ -94,7 +94,7 @@ jobs: steps: - name: Download distribution packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: python-package-distributions path: dist/ diff --git a/.github/workflows/publish-rust.yml b/.github/workflows/publish-rust.yml index 3b96cb01..b4ace631 100644 --- a/.github/workflows/publish-rust.yml +++ b/.github/workflows/publish-rust.yml @@ -27,10 +27,10 @@ jobs: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Rust - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: toolchain: ${{ env.RUST_VERSION }} @@ -59,12 +59,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Set up Rust - uses: actions-rust-lang/setup-rust-toolchain@v1 + uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 with: toolchain: ${{ env.RUST_VERSION }} diff --git a/.github/workflows/publish-web.yml b/.github/workflows/publish-web.yml index ae46237b..865948c2 100644 --- a/.github/workflows/publish-web.yml +++ b/.github/workflows/publish-web.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout your repository using git - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set site URL based on repository run: | @@ -28,7 +28,7 @@ jobs: echo "Set site URL to: $SITE_URL" - name: Install, build, and upload your site - uses: withastro/action@v4 + uses: withastro/action@a4407e937037e68022f04ae1c068d3634f08bc8d # v4.2.1 with: path: ./docs @@ -41,4 +41,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml index 978ca95f..aba1bc41 100644 --- a/.github/workflows/test-rust.yml +++ b/.github/workflows/test-rust.yml @@ -23,7 +23,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Rust uses: dtolnay/rust-toolchain@master