From 67593ae11762bfa5ea062e4bd88e086d75001f42 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 19 Aug 2026 13:39:17 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/workflows/check-rendered-specs-stub.yml | 2 +- .github/workflows/spec-review-stub.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-rendered-specs-stub.yml b/.github/workflows/check-rendered-specs-stub.yml index 8176fd7854b..fc42a24cf76 100644 --- a/.github/workflows/check-rendered-specs-stub.yml +++ b/.github/workflows/check-rendered-specs-stub.yml @@ -32,7 +32,7 @@ jobs: # Prevent forks from running a stale/vulnerable copy of this stub with Actions enabled if: github.repository == 'microsoft/azurelinux' # Intentionally branch-pinned so the reusable workflow picks up updates automatically. - uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@4.0 # zizmor: ignore[unpinned-uses] + uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@5c9b2dea9bb17e0f9964fb4097426fc28215e21a # 4.0 permissions: contents: read pull-requests: write # Post/update/delete drift comments on PRs diff --git a/.github/workflows/spec-review-stub.yml b/.github/workflows/spec-review-stub.yml index 6bb0145fd1e..6380428c868 100644 --- a/.github/workflows/spec-review-stub.yml +++ b/.github/workflows/spec-review-stub.yml @@ -38,7 +38,7 @@ jobs: if: github.repository == 'microsoft/azurelinux' # Intentionally branch-pinned to our own repo so the # reusable workflow picks up prompt/script/agent updates automatically. - uses: microsoft/azurelinux/.github/workflows/spec-review.yml@4.0 # zizmor: ignore[unpinned-uses] + uses: microsoft/azurelinux/.github/workflows/spec-review.yml@5c9b2dea9bb17e0f9964fb4097426fc28215e21a # 4.0 permissions: contents: read pull-requests: write # Post review comments and inline annotations on PRs