From b53d2ebf9700df34cef08e88a32e7f784a10c10c Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 16 Sep 2026 09:55:41 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/auto-merge-dependabot.yml | 2 +- .github/workflows/node.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- 4 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b9bddc9..f02c3fa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,3 +8,5 @@ updates: directory: "/" # Location of package manifests schedule: interval: weekly + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index 536d928..1f8110d 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3.1.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml index bd295f1..ae9f83f 100644 --- a/.github/workflows/node.yml +++ b/.github/workflows/node.yml @@ -15,9 +15,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify npm all runs and build output matches - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '24' - run: npm ci diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a6962b0..cb150d7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,19 +13,19 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: '0' - name: Bump version and push tag id: version - uses: anothrNick/github-tag-action@1.75.0 + uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} WITH_V: true DEFAULT_BUMP: patch RELEASE_BRANCHES: release - name: Create release - uses: ncipollo/release-action@v1.21.0 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: