From e2bc306322637d692647dfe97f3e9381c5e4e8cd Mon Sep 17 00:00:00 2001
From: GitHub Security Bot
 <88103841+github-security-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:29:11 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml                       | 8 ++++++++
 .github/workflows/build-deploy.yml           | 4 ++--
 .github/workflows/event-submission-check.yml | 4 ++--
 .github/workflows/event-submission-pr.yml    | 4 ++--
 .github/workflows/test.yml                   | 4 ++--
 5 files changed, 16 insertions(+), 8 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..6cc00712d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml
index 5a8656faa..75a14a429 100644
--- a/.github/workflows/build-deploy.yml
+++ b/.github/workflows/build-deploy.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout 🛎️
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Install and Build 🔧
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
         with:
           node-version: '>=18.17.0'
 
diff --git a/.github/workflows/event-submission-check.yml b/.github/workflows/event-submission-check.yml
index 72a4ff1d2..4868ceee4 100644
--- a/.github/workflows/event-submission-check.yml
+++ b/.github/workflows/event-submission-check.yml
@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: npm
diff --git a/.github/workflows/event-submission-pr.yml b/.github/workflows/event-submission-pr.yml
index a4bb8681c..2a6f2b8ce 100644
--- a/.github/workflows/event-submission-pr.yml
+++ b/.github/workflows/event-submission-pr.yml
@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           token: ${{ secrets.MAINTAINER_MONTH_BOT_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: npm
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9fc39e4e3..fb0ab4282 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout 🛎️
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Install, Test, and Build 🔧
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
         with:
           node-version: '20'