From c28e91cf99c1666a513371aa9ba8c119ff22635f Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 13:06:23 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/linux.yml | 2 +- .github/workflows/macos.yml | 4 ++-- .github/workflows/windows.yml | 4 ++-- 4 files changed, 16 insertions(+), 5 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 486542c4..9a058ad6 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.1.3 + - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3 with: submodules: true diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 16b94358..8db07fe0 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -12,12 +12,12 @@ jobs: runs-on: macos-13 steps: - - uses: actions/checkout@v4.1.3 + - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3 with: submodules: true - name: Cache vcpkg - uses: actions/cache@v4.0.2 + uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 id: cache-vcpkg with: path: build/vcpkg_cache/ diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 3e3796bf..5b92f4bf 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -14,7 +14,7 @@ jobs: runs-on: windows-latest steps: - - uses: actions/checkout@v4.1.3 + - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3 with: submodules: true @@ -24,7 +24,7 @@ jobs: run: echo "vcpkg_triplet=${{ matrix.arch }}-windows$(if ('${{ matrix.libs }}' -eq 'static') { '-static' })" >> $env:GITHUB_OUTPUT - name: Cache vcpkg - uses: actions/cache@v4.0.2 + uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 id: cache-vcpkg with: path: build/vcpkg_cache/