From d53e5471fcc417c51b5f043136d532258dd77ffa Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sat, 5 Sep 2026 23:05:48 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/ci-test.yml | 10 +++++----- .github/workflows/close-stale-issues.yml | 6 +++--- .github/workflows/emacs-test.yml | 6 +++--- .github/workflows/vim-test.yml | 12 ++++++------ 5 files changed, 28 insertions(+), 17 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml index bac41ddc9..3db9462a7 100644 --- a/.github/workflows/ci-test.yml +++ b/.github/workflows/ci-test.yml @@ -27,10 +27,10 @@ jobs: DOTNET_GENERATE_ASPNET_CERTIFICATE: false steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dotnet - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: cache: true cache-dependency-path: '**/*.csproj' @@ -41,7 +41,7 @@ jobs: run: ./tools/installPSResources.ps1 - name: Download PowerShell install script - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: PowerShell/PowerShell path: pwsh @@ -69,13 +69,13 @@ jobs: - name: Upload build artifacts if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: PowerShellEditorServices-module-${{ matrix.os }} path: module - name: Upload test results - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: PowerShellEditorServices-test-results-${{ matrix.os }} diff --git a/.github/workflows/close-stale-issues.yml b/.github/workflows/close-stale-issues.yml index 7349ee838..b96ff1df7 100644 --- a/.github/workflows/close-stale-issues.yml +++ b/.github/workflows/close-stale-issues.yml @@ -11,7 +11,7 @@ jobs: stale-resolved-issues: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 name: Label resolved issues as needing fix verification with: any-of-labels: "Resolution-Answered,Resolution-Duplicate,Resolution-External,Resolution-Fixed,Resolution-Inactive" @@ -23,7 +23,7 @@ jobs: stale-fixed-issues: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 name: Close issues needing fix verification after 1 week of inactivity with: stale-issue-label: "Needs: Fix Verification" @@ -34,7 +34,7 @@ jobs: stale-feedback-issues: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 name: Close issues needing author feedback after 1 week of inactivity with: stale-issue-label: "Needs: Author Feedback" diff --git a/.github/workflows/emacs-test.yml b/.github/workflows/emacs-test.yml index be3296b6c..928053396 100644 --- a/.github/workflows/emacs-test.yml +++ b/.github/workflows/emacs-test.yml @@ -21,10 +21,10 @@ jobs: DOTNET_GENERATE_ASPNET_CERTIFICATE: false steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dotnet - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: cache: true cache-dependency-path: '**/*.csproj' @@ -38,7 +38,7 @@ jobs: run: Invoke-Build Build - name: Install Emacs - uses: purcell/setup-emacs@v8.0 + uses: purcell/setup-emacs@bdc64dc730ae1fcba200bfd52cb1b4cf6159cbe5 # v8.0 with: version: '28.2' diff --git a/.github/workflows/vim-test.yml b/.github/workflows/vim-test.yml index 9935e6803..e02d75e0c 100644 --- a/.github/workflows/vim-test.yml +++ b/.github/workflows/vim-test.yml @@ -21,10 +21,10 @@ jobs: DOTNET_GENERATE_ASPNET_CERTIFICATE: false steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dotnet - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: cache: true cache-dependency-path: '**/*.csproj' @@ -39,18 +39,18 @@ jobs: - name: Install Vim id: vim - uses: rhysd/action-setup-vim@v1 + uses: rhysd/action-setup-vim@febef33995d6649302e9d88dda81e071b68f16a7 # v1.6.1 with: version: nightly - name: Checkout vim-ps1 - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: PProvost/vim-ps1 path: vim-ps1 - name: Checkout LanguageClient-neovim - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: autozimu/LanguageClient-neovim path: LanguageClient-neovim @@ -60,7 +60,7 @@ jobs: working-directory: LanguageClient-neovim - name: Checkout Themis - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: thinca/vim-themis path: vim-themis