From 0cbbfabea8e39c5cb83e865b9600ec17aab7350d Mon Sep 17 00:00:00 2001
From: Tim Smith <tsmith84@proton.me>
Date: Fri, 28 Aug 2026 09:19:22 -0700
Subject: [PATCH] Pin GitHub Actions to commit SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tags and branch refs are mutable pointers. Anyone who can push to an action's
repository can repoint `@v1` — or `@main` — at new code, and every workflow
referencing it picks that up on the next run with no change on our side. A
commit SHA cannot be repointed.

Three references here floated on a branch head rather than any version at all:

    actionshub/dco@main
    actionshub/get-pr-commits@main
    fernandrone/linelint@master

Each pin keeps the version in a trailing `# vX.Y.Z` comment, which is what
Dependabot reads to bump it later. Pins stay inside the major version already
in use, so this is a conversion rather than an upgrade; the `@main` and
`@master` refs move to the latest tagged release, since an untagged commit
gives Dependabot nothing to track.

Also adds a dependabot.yml. There was none, so nothing would ever bump the new
SHA pins, and no bundler updates were being tracked either.

ci-main-pull-request-stub-1.0.7.yml is deliberately untouched. It references a
reusable workflow in chef/common-github-actions, not a third-party action, and
pinning it would cut this repo off from centrally-managed CI updates.

Signed-off-by: Tim Smith <tsmith84@proton.me>
---
 .github/dependabot.yml          | 15 +++++++++++++++
 .github/workflows/allchecks.yml |  2 +-
 .github/workflows/dco.yml       |  4 ++--
 .github/workflows/lint.yml      | 15 ++++++++-------
 4 files changed, 26 insertions(+), 10 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..11fab27
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+---
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: "/"
+    schedule:
+      interval: weekly
+
+  # Workflow actions are pinned to immutable commit SHAs, so nothing bumps them
+  # without Dependabot. It reads the trailing "# vX.Y.Z" comment on each `uses:`
+  # to know the current version and rewrites both the SHA and the comment.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/allchecks.yml b/.github/workflows/allchecks.yml
index c51c3d6..00b9b9e 100644
--- a/.github/workflows/allchecks.yml
+++ b/.github/workflows/allchecks.yml
@@ -10,7 +10,7 @@ jobs:
       checks: read
       contents: read
     steps:
-      - uses: wechuli/allcheckspassed@v1
+      - uses: wechuli/allcheckspassed@e22f45a4f25f4cf821d1273705ac233355400db1 # v1.2.0
         with:
           # This seems to be working lately even for external
           # contributors, so maybe we don't need to exclude it?
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 0ae9f32..4886b26 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -12,12 +12,12 @@ jobs:
     name: DCO Check
     steps:
     - name: Get PR Commits
-      uses: actionshub/get-pr-commits@main
+      uses: actionshub/get-pr-commits@0f1d778e95718cdf9a80f57d36c0a8754e874fa1 # v2.0.0
       id: 'get-pr-commits'
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
     - name: DCO Check
-      uses: actionshub/dco@main
+      uses: actionshub/dco@624651527997baebfe5fd772d216f9c77bfd40f3 # v2.0.0
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
         allow-obvious-fix-label: "obvious-fix"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 90ae24c..3c887f2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,12 +17,13 @@ jobs:
     env:
       BUNDLE_WITHOUT: ruby_shadow:packaging
     steps:
-      - uses: actions/checkout@v6
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 3.4
           bundler-cache: false
-      - uses: r7kamura/rubocop-problem-matchers-action@v1  # this shows the failures in the PR
+      # shows the failures in the PR
+      - uses: r7kamura/rubocop-problem-matchers-action@59f1a0759f50cc2649849fd850b8487594bb5a81 # v1.2.2
       - run: |
           bundle install
           bundle exec cookstyle --chefstyle -c .rubocop.yml
@@ -30,17 +31,17 @@ jobs:
   spellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - run: |
           curl --location 'https://raw.githubusercontent.com/chef/chef_dictionary/main/chef.txt' --output chef_dictionary.txt
-      - uses: streetsidesoftware/cspell-action@v8.4.0
+      - uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8.4.0
 
   linelint:
     runs-on: ubuntu-latest
     name: Check if all files end in newline
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Linelint
-        uses: fernandrone/linelint@master
+        uses: fernandrone/linelint@7907a5dca0c28ea7dd05c6d8d8cacded713aca11 # 0.0.6
         id: linelint