From 073a132288bbbdc12e15d80fa2912790a0d70e65 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 7 Oct 2026 18:13:39 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml        | 2 ++
 .github/workflows/main.yml    | 2 +-
 .github/workflows/node.yml    | 4 ++--
 .github/workflows/release.yml | 4 ++--
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b9bddc9..f02c3fa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,5 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7ffeddc..e4e651a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -18,4 +18,4 @@ jobs:
         repoToken: ${{ secrets.GITHUB_TOKEN }}
         excludeFiles: '**/**.map;package.json'
       id: validate
-      uses: microsoftgraph/eol-blocker@main
+      uses: microsoftgraph/eol-blocker@14648e1b1978662860dcc551e70aeb13ad741486 # v1.0.15
diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml
index bd295f1..ae9f83f 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/node.yml
@@ -15,9 +15,9 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Verify npm all runs and build output matches
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '24'
     - run: npm ci
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 90dad1b..cb150d7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,12 +13,12 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: '0'
     - name: Bump version and push tag
       id: version
-      uses: anothrNick/github-tag-action@1.75.0
+      uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         WITH_V: true