From a0aec3c69f05dfd7e988411d728583be85b302b3 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 16 Sep 2026 10:24:05 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/api-level-lint.yml | 8 ++++---- .github/workflows/auto-merge-dependabot.yml | 2 +- .github/workflows/codeql-analysis.yml | 8 ++++---- .github/workflows/maven-build.yml | 12 ++++++------ .github/workflows/project-auto-add.yml | 2 +- .github/workflows/release-please-gha.yml | 6 +++--- .github/workflows/validate-public-api-surface.yml | 6 +++--- 8 files changed, 24 insertions(+), 22 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 054f172220c..5d500da402a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -35,3 +35,5 @@ updates: all-actions: patterns: - "*" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/api-level-lint.yml b/.github/workflows/api-level-lint.yml index ba5ef12d65f..fabc7169316 100644 --- a/.github/workflows/api-level-lint.yml +++ b/.github/workflows/api-level-lint.yml @@ -11,8 +11,8 @@ jobs: lint-api-level: runs-on: [self-hosted, 1ES.Pool=1es-ubuntu-msgraph-sdk-java-memory-latest-m] steps: - - uses: actions/checkout@v6 - - uses: actions/setup-java@v5 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: 'temurin' java-version: 21 @@ -21,7 +21,7 @@ jobs: run: .\scripts\copyFilesOnBuild.ps1 -inputPath '.\src\main\java\com\microsoft\graph\generated' shell: pwsh - name: Setup Android SDK - uses: android-actions/setup-android@v4.0.1 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 - name: Add execution right to the script run: chmod +x gradlew working-directory: ./android @@ -31,7 +31,7 @@ jobs: working-directory: ./android - name: Upload linting results if: failure() && steps.lint.outcome == 'failure' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: lint-report path: ./android/build/reports diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index 9d903943300..a3343774ed5 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3.1.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 2e6fb0173b4..8f7e1a4a12b 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -42,10 +42,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 21 distribution: 'temurin' @@ -53,7 +53,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -79,6 +79,6 @@ jobs: run: ./mvnw compile --no-transfer-progress -DskipTests - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml index e90d5803d31..f0a0e985226 100644 --- a/.github/workflows/maven-build.yml +++ b/.github/workflows/maven-build.yml @@ -11,9 +11,9 @@ jobs: build-java-latest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 21 distribution: 'temurin' @@ -25,13 +25,13 @@ jobs: run: ./mvnw verify --no-transfer-progress - name: Upload Unit Test Results if: ${{ always() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: UnitTests path: | target/surefire-reports/** - name: Upload a Build Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: drop path: | @@ -45,9 +45,9 @@ jobs: build-java-8: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 8 distribution: 'temurin' diff --git a/.github/workflows/project-auto-add.yml b/.github/workflows/project-auto-add.yml index d47299783c6..2527d267c6d 100644 --- a/.github/workflows/project-auto-add.yml +++ b/.github/workflows/project-auto-add.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Generate token id: generate_token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ secrets.GRAPHBOT_APP_ID }} private-key: ${{ secrets.GRAPHBOT_APP_PEM }} diff --git a/.github/workflows/release-please-gha.yml b/.github/workflows/release-please-gha.yml index b6bc742e5b1..de77c20ce38 100644 --- a/.github/workflows/release-please-gha.yml +++ b/.github/workflows/release-please-gha.yml @@ -19,17 +19,17 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ vars.RELEASE_PLEASE_TOKEN_PROVIDER_APP_ID }} private-key: ${{ secrets.RELEASE_PLEASE_TOKEN_PROVIDER_PEM }} - name: Release Please - uses: googleapis/release-please-action@v5 + uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: token: ${{ steps.app-token.outputs.token }} config-file: release-please-config.json diff --git a/.github/workflows/validate-public-api-surface.yml b/.github/workflows/validate-public-api-surface.yml index 1586c14b54c..8aa58a79c37 100644 --- a/.github/workflows/validate-public-api-surface.yml +++ b/.github/workflows/validate-public-api-surface.yml @@ -17,7 +17,7 @@ jobs: validate-public-api-surface: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: microsoftgraph/kiota-dom-export-diff-tool/export@main id: generatePatch - uses: microsoftgraph/kiota-dom-export-diff-tool/tool@main @@ -35,14 +35,14 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload patch file as artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: name: patch path: '*.patch' - name: Upload explanations file as artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: name: explanations