From fb9a9ee2728b2ff26684e899bfcc011f0f973671 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 19 Aug 2026 11:48:15 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/build.yml | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 289af225..d4745df3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,12 @@ updates: directory: "/azure_devops_rust_api" # Location of package manifests schedule: interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 050049b6..093d9325 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: vsts-api-patcher fmt run: cd vsts-api-patcher && cargo fmt --check - name: azure_devops_rust_api fmt