From ba04a07e9558cfc9c5610f57060d074260fec559 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 7 Oct 2026 18:16:56 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/api-level-lint.yml | 8 ++++---- .github/workflows/auto-merge-dependabot.yml | 2 +- .github/workflows/codeql-analysis.yml | 8 ++++---- .github/workflows/conflicting-pr-label.yml | 2 +- .github/workflows/maven-build.yml | 12 ++++++------ .github/workflows/project-auto-add.yml | 2 +- .github/workflows/release-please-gha.yml | 6 +++--- .github/workflows/validate-public-api-surface.yml | 6 +++--- 9 files changed, 25 insertions(+), 23 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 054f172220c..5d500da402a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -35,3 +35,5 @@ updates: all-actions: patterns: - "*" + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/api-level-lint.yml b/.github/workflows/api-level-lint.yml index b694242e8fe..f382159c089 100644 --- a/.github/workflows/api-level-lint.yml +++ b/.github/workflows/api-level-lint.yml @@ -11,8 +11,8 @@ jobs: lint-api-level: runs-on: [self-hosted, 1ES.Pool=1es-ubuntu-msgraph-sdk-java-memory-latest-m] steps: - - uses: actions/checkout@v6 - - uses: actions/setup-java@v5 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: 'temurin' java-version: 21 @@ -21,7 +21,7 @@ jobs: run: .\scripts\copyFilesOnBuild.ps1 -inputPath '.\src\main\java\com\microsoft\graph\generated' shell: pwsh - name: Setup Android SDK - uses: android-actions/setup-android@v4.0.1 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 with: packages: 'platform-tools' - name: Add execution right to the script @@ -33,7 +33,7 @@ jobs: working-directory: ./android - name: Upload linting results if: failure() && steps.lint.outcome == 'failure' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: lint-report path: ./android/build/reports diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index 9d903943300..a3343774ed5 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3.1.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 2e6fb0173b4..5f1e3d06cd8 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -42,10 +42,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 21 distribution: 'temurin' @@ -53,7 +53,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -79,6 +79,6 @@ jobs: run: ./mvnw compile --no-transfer-progress -DskipTests - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/conflicting-pr-label.yml b/.github/workflows/conflicting-pr-label.yml index ad0d1af638b..03823fc6a6e 100644 --- a/.github/workflows/conflicting-pr-label.yml +++ b/.github/workflows/conflicting-pr-label.yml @@ -21,7 +21,7 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: - name: check if prs are dirty - uses: eps1lon/actions-label-merge-conflict@releases/2.x + uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0 if: env.LABELING_TOKEN != '' && env.LABELING_TOKEN != null id: check with: diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml index e90d5803d31..d1e90849fda 100644 --- a/.github/workflows/maven-build.yml +++ b/.github/workflows/maven-build.yml @@ -11,9 +11,9 @@ jobs: build-java-latest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 21 distribution: 'temurin' @@ -25,13 +25,13 @@ jobs: run: ./mvnw verify --no-transfer-progress - name: Upload Unit Test Results if: ${{ always() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: UnitTests path: | target/surefire-reports/** - name: Upload a Build Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: drop path: | @@ -45,9 +45,9 @@ jobs: build-java-8: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: 8 distribution: 'temurin' diff --git a/.github/workflows/project-auto-add.yml b/.github/workflows/project-auto-add.yml index d47299783c6..2527d267c6d 100644 --- a/.github/workflows/project-auto-add.yml +++ b/.github/workflows/project-auto-add.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Generate token id: generate_token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ secrets.GRAPHBOT_APP_ID }} private-key: ${{ secrets.GRAPHBOT_APP_PEM }} diff --git a/.github/workflows/release-please-gha.yml b/.github/workflows/release-please-gha.yml index b6bc742e5b1..de77c20ce38 100644 --- a/.github/workflows/release-please-gha.yml +++ b/.github/workflows/release-please-gha.yml @@ -19,17 +19,17 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ vars.RELEASE_PLEASE_TOKEN_PROVIDER_APP_ID }} private-key: ${{ secrets.RELEASE_PLEASE_TOKEN_PROVIDER_PEM }} - name: Release Please - uses: googleapis/release-please-action@v5 + uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: token: ${{ steps.app-token.outputs.token }} config-file: release-please-config.json diff --git a/.github/workflows/validate-public-api-surface.yml b/.github/workflows/validate-public-api-surface.yml index 1586c14b54c..06d97138be9 100644 --- a/.github/workflows/validate-public-api-surface.yml +++ b/.github/workflows/validate-public-api-surface.yml @@ -17,7 +17,7 @@ jobs: validate-public-api-surface: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: microsoftgraph/kiota-dom-export-diff-tool/export@main id: generatePatch - uses: microsoftgraph/kiota-dom-export-diff-tool/tool@main @@ -35,14 +35,14 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload patch file as artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 continue-on-error: true with: name: patch path: '*.patch' - name: Upload explanations file as artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 continue-on-error: true with: name: explanations