From c13698f60c51f9b370f5b4ff7c96beba0f0f1623 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 19 Aug 2026 11:54:37 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/devskim.yml | 6 +++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1f0b7af89..876b91c8e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,3 +14,12 @@ updates: directory: "/azure-quantum/" # Location of package manifests schedule: interval: "daily" + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml index 73414bb05..83101c4c6 100644 --- a/.github/workflows/devskim.yml +++ b/.github/workflows/devskim.yml @@ -20,12 +20,12 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Run DevSkim scanner - uses: microsoft/DevSkim-Action@v1 + uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1.0.16 - name: Upload DevSkim scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 with: sarif_file: devskim-results.sarif