From 8af3836ddc3c36b2af0031120ffb894c1e237f60 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 11:17:31 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/copilot-setup-steps.yml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 13f2a908..49fae274 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,6 +19,8 @@ updates: - .github/workflows/*.lock.yml # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump. - .github/workflows/copilot-setup-steps.yml open-pull-requests-limit: 10 + cooldown: + default-days: 7 - package-ecosystem: gomod directory: /eng/ci-tools schedule: diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 1f9bde48..19198a65 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install gh-aw extension uses: github/gh-aw-actions/setup-cli@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14 with: