From 27e1072a408286b370b72141eb73202cd623025e Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 12 Aug 2026 12:34:39 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                    | 11 +++++++++++
 .github/workflows/android.yml             |  4 ++--
 .github/workflows/clang-format.yml        |  2 +-
 .github/workflows/cmake_find_package.yml  |  2 +-
 .github/workflows/compilers.yml           | 12 ++++++------
 .github/workflows/copilot-setup-steps.yml |  2 +-
 .github/workflows/shell-script-linter.yml |  2 +-
 7 files changed, 23 insertions(+), 12 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..2c48305b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 2d48fa561..02642dbaf 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -17,13 +17,13 @@ jobs:
       run:
         working-directory: build
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Create build directory
         run: mkdir -p build
         working-directory: .
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 8
           distribution: zulu
diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index ddb373d2c..00aff4835 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Install the exact clang-format binary
       - name: Install clang-format
diff --git a/.github/workflows/cmake_find_package.yml b/.github/workflows/cmake_find_package.yml
index 5e19c8dcb..56456584a 100644
--- a/.github/workflows/cmake_find_package.yml
+++ b/.github/workflows/cmake_find_package.yml
@@ -13,7 +13,7 @@ jobs:
       matrix:
         os: [ ubuntu-latest, macos-latest ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: lukka/get-cmake@latest
         with:
           cmakeVersion: 3.14.0
diff --git a/.github/workflows/compilers.yml b/.github/workflows/compilers.yml
index 6681e1a15..28872f6f7 100644
--- a/.github/workflows/compilers.yml
+++ b/.github/workflows/compilers.yml
@@ -30,7 +30,7 @@ jobs:
             cxx_version: 23
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Run CMake (configure, build, test)
         uses: ./.github/workflows/cmake
@@ -51,7 +51,7 @@ jobs:
             cxx_version: 23
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      
       - name: Run CMake (configure, build, test)
         uses: ./.github/workflows/cmake
@@ -66,7 +66,7 @@ jobs:
         cxx_version: [ 14, 17, 20, 23 ]
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: select xcode version
         run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app
@@ -93,9 +93,9 @@ jobs:
             generator_override: '-G "Visual Studio 17 2022" -T ClangCL'
     runs-on: ${{ matrix.image }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: microsoft/setup-msbuild@v3
-      - uses: ilammy/msvc-dev-cmd@v1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
 
       - name: Run CMake (configure, build, test)
         uses: ./.github/workflows/cmake
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index d37f633df..840d474f4 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -9,7 +9,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install Build Dependencies
         run: sudo apt-get update && sudo apt-get install -y clang cmake make
diff --git a/.github/workflows/shell-script-linter.yml b/.github/workflows/shell-script-linter.yml
index c31c51102..0eca4942b 100644
--- a/.github/workflows/shell-script-linter.yml
+++ b/.github/workflows/shell-script-linter.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Install the needed binaries
       - name: Install shfmt and shellcheck