Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/BlockNewPullRequests.yml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Comment and close PR
         if: steps.check.outputs.block == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/CICD.yaml

@@ -227,7 +227,7 @@ jobs:
           shell: powershell
 
       - name: Upload SARIF file to GitHub
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         if: (success() || failure()) && (hashFiles(format('{0}/ErrorLogs/output.sarif.json',github.workspace)) != '')
         with:
           sarif_file: '${{ github.workspace }}/ErrorLogs/output.sarif.json'

.github/workflows/CreateBuildTag.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Get Build Version
         id: GetBuildVersion
@@ -31,7 +31,7 @@ jobs:
           Add-Content -Encoding UTF8 -Path $env:GITHUB_OUTPUT -Value "BuildVersion=$buildVersion"
 
       - name: Create version tag
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         env:
           BuildVersion: ${{ steps.GetBuildVersion.outputs.BuildVersion}}
         with:

.github/workflows/ProcessPRLabel.yaml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
     - name: Post comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
@@ -34,7 +34,7 @@ jobs:
 
     steps:
     - name: Post comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |

.github/workflows/PullRequestHandler.yaml

@@ -144,7 +144,7 @@ jobs:
           shell: powershell
 
       - name: Upload SARIF file to GitHub
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         if: (success() || failure()) && (hashFiles(format('{0}/ErrorLogs/output.sarif.json',github.workspace)) != '')
         with:
           sarif_file: '${{ github.workspace }}/ErrorLogs/output.sarif.json'

.github/workflows/UpdateBCArtifactVersion.yaml

@@ -17,7 +17,7 @@ jobs:
       UpdateBranches: ${{ steps.GetBranches.outputs.UpdateBranches }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Get Branches
         id: GetBranches
@@ -41,7 +41,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           ref: ${{ matrix.branch }}
 

.github/workflows/UpdatePackageVersions.yaml

@@ -17,7 +17,7 @@ jobs:
       UpdateBranches: ${{ steps.GetBranches.outputs.UpdateBranches }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Get Branches
         id: GetBranches
@@ -41,7 +41,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           ref: ${{ matrix.branch }}
 

.github/workflows/WorkitemValidation.yaml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Validate work items for pull request
         env:
@@ -40,7 +40,7 @@ jobs:
     needs: GitHubIssueValidation
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Link work items to pull request if possible
         env:

.github/workflows/argus-extensibility-triage-feedback.yml

@@ -35,18 +35,18 @@ jobs:
 
           echo "skip=false" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         if: steps.detect.outputs.skip == 'false'
 
       - name: Checkout BCAppsTriage source
         if: steps.detect.outputs.skip == 'false'
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           repository: ${{ github.repository_owner }}/BCAppsTriage
           token: ${{ secrets.EXT_TRIAGE_SOURCE_TOKEN }}
           path: _triage-src
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         if: steps.detect.outputs.skip == 'false'
         with:
           node-version: '22'
@@ -124,7 +124,7 @@ jobs:
       # ── Step 3: Log telemetry ────────────────────────────────────────────────
       - name: Azure login (OIDC)
         if: steps.detect.outputs.skip == 'false' && steps.context.outputs.skip == 'false'
-        uses: azure/login@v3
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/argus-extensibility-triage-scheduled.yml

@@ -137,16 +137,16 @@ jobs:
         issue: ${{ fromJson(needs.discover.outputs.issues) }}
       fail-fast: false   # one failing issue must not block the others
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Checkout BCAppsTriage source
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           repository: ${{ github.repository_owner }}/BCAppsTriage
           token: ${{ secrets.EXT_TRIAGE_SOURCE_TOKEN }}
           path: _triage-src
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
 
@@ -161,7 +161,7 @@ jobs:
         run: chmod +x _triage-src/internal/Argus_Triage_Extensibility_Requests/scripts/process-issue.sh
 
       - name: Azure login (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -180,7 +180,7 @@ jobs:
 
       - name: Upload result artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: argus-result-${{ github.run_id }}-issue-${{ matrix.issue }}
           path: _triage-src/internal/Argus_Triage_Extensibility_Requests/data/argus_result.json