From 3535237c446855cba334a4e2b0ce91aa62e3964d Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 15:32:37 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/main-build.yml | 8 ++++---- .github/workflows/push-to-docker-hub.yml | 12 ++++++------ .github/workflows/push-to-nuget.yml | 6 +++--- .github/workflows/push-to-vscode-marketplace.yml | 4 ++-- 5 files changed, 26 insertions(+), 15 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2c48305 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/main-build.yml b/.github/workflows/main-build.yml index b2cd1aa..6c0ad0a 100644 --- a/.github/workflows/main-build.yml +++ b/.github/workflows/main-build.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: create ArtifactStagingDirectory folder run: mkdir drop @@ -41,7 +41,7 @@ jobs: # Building and testing .NET - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x @@ -94,7 +94,7 @@ jobs: run: cp durablefunctionsmonitor.dotnetisolated/LICENSE.txt drop/durablefunctionsmonitor.dotnetisolated/output - name: Install latest nuget.exe - uses: nuget/setup-nuget@v1.2.0 + uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f # v1.2.0 - name: package dotnetbackend into a Nuget package run: nuget pack drop/durablefunctionsmonitor.dotnetbackend/output/nuspec.nuspec -OutputDirectory drop - name: package dotnetisolated into a Nuget package @@ -103,7 +103,7 @@ jobs: # Publish artifacts - name: publish artifacts - uses: actions/upload-artifact@v4.1.0 + uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0 with: path: drop diff --git a/.github/workflows/push-to-docker-hub.yml b/.github/workflows/push-to-docker-hub.yml index 707df2e..322e49d 100644 --- a/.github/workflows/push-to-docker-hub.yml +++ b/.github/workflows/push-to-docker-hub.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Building and copying React @@ -38,7 +38,7 @@ jobs: # Building and testing .NET - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x @@ -48,27 +48,27 @@ jobs: run: dotnet test tests/durablefunctionsmonitor.dotnetisolated.core.tests/*.csproj - name: login to Docker hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: build and push durablefunctionsmonitor.dotnetbackend - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./durablefunctionsmonitor.dotnetbackend push: true tags: scaletone/durablefunctionsmonitor:${{ github.event.inputs.imageTag }} - name: build and push custom-backends/mssql - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./custom-backends/mssql push: true tags: scaletone/durablefunctionsmonitor.mssql:${{ github.event.inputs.imageTag }} - name: build and push custom-backends/netherite - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./custom-backends/netherite push: true diff --git a/.github/workflows/push-to-nuget.yml b/.github/workflows/push-to-nuget.yml index 5eeaf94..9527d21 100644 --- a/.github/workflows/push-to-nuget.yml +++ b/.github/workflows/push-to-nuget.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: create ArtifactStagingDirectory folder run: mkdir drop @@ -37,7 +37,7 @@ jobs: # Building and testing .NET - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x @@ -69,7 +69,7 @@ jobs: run: cp durablefunctionsmonitor.dotnetisolated/LICENSE.txt drop/dotnetIsolated-mssql/output - name: Install latest nuget.exe - uses: nuget/setup-nuget@v1.2.0 + uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f # v1.2.0 - name: package dotnetbackend into a Nuget package run: nuget pack drop/durablefunctionsmonitor.dotnetbackend/output/nuspec.nuspec -OutputDirectory drop - name: package dotnetisolated into a Nuget package diff --git a/.github/workflows/push-to-vscode-marketplace.yml b/.github/workflows/push-to-vscode-marketplace.yml index a6a1e2b..e4b1166 100644 --- a/.github/workflows/push-to-vscode-marketplace.yml +++ b/.github/workflows/push-to-vscode-marketplace.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: create ArtifactStagingDirectory folder run: mkdir drop @@ -37,7 +37,7 @@ jobs: # Building and testing .NET - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x