From 326babc91b04561e59f92390fcde7b95cdaa6b16 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 20:44:38 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/CI.yml | 4 ++-- .github/workflows/update-pinned-libs.yml | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5ace4600..a1203f0c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,5 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index e3c4e3fa..411e59c7 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -28,7 +28,7 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: - name: Maximize build space - uses: AdityaGarg8/remove-unwanted-software@v5 + uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 # v5 with: remove-dotnet: 'true' remove-android: 'true' @@ -37,7 +37,7 @@ jobs: remove-docker-images: 'true' # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Build base dockerfile - name: Build the base.Dockerfile diff --git a/.github/workflows/update-pinned-libs.yml b/.github/workflows/update-pinned-libs.yml index aa1cdbb2..b5e8f2a4 100644 --- a/.github/workflows/update-pinned-libs.yml +++ b/.github/workflows/update-pinned-libs.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0