From fea154b0cbcfd8c479fb8c6e754c1c2622572ea7 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sun, 23 Aug 2026 13:02:42 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/build-test.yml | 12 ++++++------ .github/workflows/dotnet-format.yml | 4 ++-- .github/workflows/hugo.yml | 10 +++++----- .github/workflows/yaml-integration-tests.yml | 6 +++--- 5 files changed, 27 insertions(+), 16 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 0e4138389..60bf98d7a 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -25,15 +25,15 @@ jobs: dotnet-version: ['8.0.x'] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Setup .NET Core SDK ${{ matrix.dotnet-version }} - uses: actions/setup-dotnet@v1 + uses: actions/setup-dotnet@871f041373faaad213a635d9afb62905ec029bbb # v1.10.1 with: dotnet-version: ${{ matrix.dotnet-version }} - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 with: languages: csharp, javascript @@ -53,12 +53,12 @@ jobs: dotnet test --configuration Release --no-restore --verbosity normal --logger:trx --collect:"XPlat Code Coverage" --results-directory ./TestResults - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 with: category: 'dotnet-version-${{ matrix.dotnet-version }}-analysis' - name: Test Report - uses: dorny/test-reporter@v1 + uses: dorny/test-reporter@d61b558e8df85cb60d09ca3e5b09653b4477cea7 # v1 if: success() || failure() # run this step even if previous step failed with: name: DotNet Tests # Name of the check run which will be created @@ -67,7 +67,7 @@ jobs: reporter: dotnet-trx # Format of test results - name: Upload test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: test-results-coverage-report path: src/TestResults/**/coverage.cobertura.xml diff --git a/.github/workflows/dotnet-format.yml b/.github/workflows/dotnet-format.yml index f3b48d05c..05b4f77db 100644 --- a/.github/workflows/dotnet-format.yml +++ b/.github/workflows/dotnet-format.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Setup .NET Core - uses: actions/setup-dotnet@v1 + uses: actions/setup-dotnet@871f041373faaad213a635d9afb62905ec029bbb # v1.10.1 with: dotnet-version: '8.0.x' @@ -25,7 +25,7 @@ jobs: run: dotnet tool install -g dotnet-format - name: Check out code - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Run dotnet format run: dotnet format '.\src\Microsoft.PowerApps.TestEngine' --verify-no-changes --severity warn diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml index a319d0ab1..a4bab689f 100644 --- a/.github/workflows/hugo.yml +++ b/.github/workflows/hugo.yml @@ -31,9 +31,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup .NET - uses: actions/setup-dotnet@v3 + uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3.4.2 with: dotnet-version: '9.0.x' - name: Publish .NET project @@ -42,7 +42,7 @@ jobs: dotnet workload install wasm-tools dotnet publish -c Release - name: Setup Hugo - uses: peaceiris/actions-hugo@v2 + uses: peaceiris/actions-hugo@16361eb4acea8698b220b76c0d4e84e1fd22c61d # v2.6.0 with: hugo-version: 'latest' - name: Build with Hugo @@ -51,7 +51,7 @@ jobs: hugo --minify - name: Upload artifact # Automatically uploads an artifact from the './public' directory by default - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: src/docs/site @@ -66,4 +66,4 @@ jobs: - name: Deploy to GitHub Pages if: ${{ github.ref == vars.SourceBranch }} id: deployment - uses: actions/deploy-pages@v4 \ No newline at end of file + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 \ No newline at end of file diff --git a/.github/workflows/yaml-integration-tests.yml b/.github/workflows/yaml-integration-tests.yml index 6839276b4..33db3f74a 100644 --- a/.github/workflows/yaml-integration-tests.yml +++ b/.github/workflows/yaml-integration-tests.yml @@ -10,7 +10,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Integration Test env: user1Email: '${{ secrets.POWER_PLATFORM_USER }}' @@ -24,14 +24,14 @@ jobs: chmod +x yaml-integration-tests.sh ./yaml-integration-tests.sh "${{ inputs.parameters }}" # run the script with the parameter, contains logic to run the tests - name: Sample Test Report - uses: dorny/test-reporter@v1.5.0 + uses: dorny/test-reporter@0d00bb14cb0cc2c9b8985df6e81dd333188224e1 # v1.5.0 if: success() || failure() # run this step even if previous step failed with: name: Sample Tests # Name of the check run which will be created path: '**/*.trx' reporter: dotnet-trx # Format of test results - name: Upload a Build Artifact - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 if: ${{always()}} with: name: 'Test Run'