From b99936964f777b7b5318d3495794149b02a25594 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 22 Aug 2026 07:52:30 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/actions-pr.yml | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 412b2c2..a23ccbb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -20,3 +20,5 @@ updates: directory: "/" schedule: interval: "monthly" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/actions-pr.yml b/.github/workflows/actions-pr.yml index c42c6e0..d629931 100644 --- a/.github/workflows/actions-pr.yml +++ b/.github/workflows/actions-pr.yml @@ -21,12 +21,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 # avoid shallow clone so nbgv can do its work. - name: Install .NET Core SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: global-json-file: global.json