From bab1c51163215090f3fb84868f93ecfc58d0ae35 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 11:42:11 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/build.yml | 14 +++++++------- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/docs.yml | 12 ++++++------ .github/workflows/test-report.yml | 2 +- 5 files changed, 29 insertions(+), 18 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3740c75f..e3e53fe6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -34,27 +34,27 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 # Deep clone is required for versioning on git commit height - name: Setup .NET 8 - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x - name: Setup .NET 9 - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 9.0.x - name: Setup .NET 10 - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 10.0.x - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} @@ -70,7 +70,7 @@ jobs: - name: Upload build artifacts if: matrix.dotnet-version == 'net10.0' && matrix.node-version == '22.x' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ matrix.os }}-${{ matrix.configuration }}-packages path: | @@ -89,7 +89,7 @@ jobs: continue-on-error: true - name: Upload test logs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: test-logs-${{ matrix.os }}-${{matrix.dotnet-version}}-node${{matrix.node-version}}-${{matrix.configuration}} path: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ffcc9033..d38a5a6d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,14 +30,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 1 # Shallow clone is enough; versioning is not important for CodeQL analysis. # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -49,7 +49,7 @@ jobs: - name: Setup .NET 10 if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 10.0.x @@ -60,6 +60,6 @@ jobs: # Disable git-versioning to prevent the shallow clone from causing build errors. - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index cc78b9c3..987cfa59 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -29,22 +29,22 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 # Not needed if lastUpdated is not enabled - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 cache: npm cache-dependency-path: './docs/package-lock.json' - name: Setup .NET - uses: actions/setup-dotnet@v4 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 10.0.x - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4.0.0 - name: Install npm packages working-directory: ./docs @@ -67,7 +67,7 @@ jobs: run: cp -r images .vitepress/dist/images - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: ./docs/.vitepress/dist @@ -80,4 +80,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 \ No newline at end of file + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 \ No newline at end of file diff --git a/.github/workflows/test-report.yml b/.github/workflows/test-report.yml index c9ae9214..e6c569a6 100644 --- a/.github/workflows/test-report.yml +++ b/.github/workflows/test-report.yml @@ -39,7 +39,7 @@ jobs: steps: - name: Publish test results - uses: dorny/test-reporter@v1 + uses: dorny/test-reporter@d61b558e8df85cb60d09ca3e5b09653b4477cea7 # v1 with: artifact: test-logs-${{ matrix.os }}-${{matrix.dotnet-version}}-node${{matrix.node-version}}-${{matrix.configuration}} name: test results (${{ matrix.os }}, ${{matrix.dotnet-version}}, node${{ matrix.node-version }}, ${{ matrix.configuration }}) From 4c4d2e298481305c789e77168c8b93389b37feeb Mon Sep 17 00:00:00 2001 From: Jason Ginchereau Date: Wed, 19 Aug 2026 09:34:05 -1000 Subject: [PATCH 2/2] Fix dorny/test-reporter v1 tag commit sha Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/test-report.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-report.yml b/.github/workflows/test-report.yml index e6c569a6..8b7a9b98 100644 --- a/.github/workflows/test-report.yml +++ b/.github/workflows/test-report.yml @@ -39,7 +39,7 @@ jobs: steps: - name: Publish test results - uses: dorny/test-reporter@d61b558e8df85cb60d09ca3e5b09653b4477cea7 # v1 + uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1 with: artifact: test-logs-${{ matrix.os }}-${{matrix.dotnet-version}}-node${{matrix.node-version}}-${{matrix.configuration}} name: test results (${{ matrix.os }}, ${{matrix.dotnet-version}}, node${{ matrix.node-version }}, ${{ matrix.configuration }})