From ae0c3a9603508411cf1515c238ecf11ed6335c69 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 19 Aug 2026 09:07:45 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml               | 2 ++
 .github/workflows/build.yml          | 8 ++++----
 .github/workflows/package-update.yml | 4 ++--
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b5ea46b3c..8f586652f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,8 @@ updates:
     schedule:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: dotnet-sdk
     directory: /
     schedule:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 29028d0da..911ad81bd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,11 +21,11 @@ jobs:
       statuses: write
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
     - name: PR Metrics
-      uses: microsoft/PR-Metrics@v1.7.17
+      uses: microsoft/PR-Metrics@0959437740572519916a08b3609e67ffa435f8dd # v1.7.17
       env:
         PR_METRICS_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -40,9 +40,9 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install .NET 10 SDK
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         dotnet-version: '10.0.x'
     - name: Install SF SDK
diff --git a/.github/workflows/package-update.yml b/.github/workflows/package-update.yml
index ddf330bc8..369d559f7 100644
--- a/.github/workflows/package-update.yml
+++ b/.github/workflows/package-update.yml
@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: global.json