From e99f8001c21d9782194851a3fe76b094e2f67103 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 15:50:46 -0700 Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 ++++++ .github/workflows/accessibility-alt-text.yml | 2 +- .github/workflows/aoe-cd-dev.yml | 2 +- .github/workflows/aoe-cd-prod.yml | 2 +- .github/workflows/aoe-cd-test.yml | 2 +- .github/workflows/dev.yml | 4 +-- .github/workflows/ftk-pr-cleanup.yml | 2 +- .github/workflows/ftk-pr-deploy.yml | 36 +++++++++---------- .github/workflows/opendata-ci.yml | 4 +-- .../opendata-commitment-eligibility.yml | 2 +- .github/workflows/publish.yml | 4 +-- .github/workflows/update-mslearn-dates.yml | 4 +-- .github/workflows/wiki-sync.yml | 4 +-- 13 files changed, 45 insertions(+), 34 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/accessibility-alt-text.yml b/.github/workflows/accessibility-alt-text.yml index 3b7e09a29..a0707faa9 100644 --- a/.github/workflows/accessibility-alt-text.yml +++ b/.github/workflows/accessibility-alt-text.yml @@ -24,4 +24,4 @@ jobs: if: ${{ github.event.issue || github.event.pull_request || github.event.discussion }} steps: - name: Get action 'github/accessibility-alt-text-bot' - uses: github/accessibility-alt-text-bot@v1.3.0 + uses: github/accessibility-alt-text-bot@b5828a5ec03d5fc67860c0f656f4abca3947cced # v1.3.0 diff --git a/.github/workflows/aoe-cd-dev.yml b/.github/workflows/aoe-cd-dev.yml index 328217476..43b80bb3c 100644 --- a/.github/workflows/aoe-cd-dev.yml +++ b/.github/workflows/aoe-cd-dev.yml @@ -32,7 +32,7 @@ jobs: Install-Module -Name Az.Automation -RequiredVersion 1.10.0 -Force Install-Module -Name Microsoft.Graph.Authentication,Microsoft.Graph.Identity.DirectoryManagement -Force - name: Check out repository code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Login via Az module uses: azure/login@hf_447_release with: diff --git a/.github/workflows/aoe-cd-prod.yml b/.github/workflows/aoe-cd-prod.yml index 09181cd7c..7f51f0810 100644 --- a/.github/workflows/aoe-cd-prod.yml +++ b/.github/workflows/aoe-cd-prod.yml @@ -32,7 +32,7 @@ jobs: Install-Module -Name Az.Automation -RequiredVersion 1.10.0 -Force Install-Module -Name Microsoft.Graph.Authentication,Microsoft.Graph.Identity.DirectoryManagement -Force - name: Check out repository code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Login via Az module uses: azure/login@hf_447_release with: diff --git a/.github/workflows/aoe-cd-test.yml b/.github/workflows/aoe-cd-test.yml index 5ed45bfa1..cb6afcb1c 100644 --- a/.github/workflows/aoe-cd-test.yml +++ b/.github/workflows/aoe-cd-test.yml @@ -32,7 +32,7 @@ jobs: Install-Module -Name Az.Automation -RequiredVersion 1.10.0 -Force Install-Module -Name Microsoft.Graph.Authentication,Microsoft.Graph.Identity.DirectoryManagement -Force - name: Check out repository code - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Login via Az module uses: azure/login@hf_447_release with: diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml index 33fc20309..9f898750a 100644 --- a/.github/workflows/dev.yml +++ b/.github/workflows/dev.yml @@ -13,11 +13,11 @@ jobs: runs-on: Windows-latest steps: - name: Install and cache PowerShell modules - uses: potatoqualitee/psmodulecache@v6.2.1 + uses: potatoqualitee/psmodulecache@ee5e9494714abf56f6efbfa51527b2aec5c761b8 # v6.2.1 with: modules-to-cache: InvokeBuild, PSScriptAnalyzer, Pester:6.0.0, Az.Accounts, Az.Resources shell: pwsh - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Run Tests shell: pwsh run: .build/start.ps1 -Task Test.PowerShell.All diff --git a/.github/workflows/ftk-pr-cleanup.yml b/.github/workflows/ftk-pr-cleanup.yml index b3d4ccb13..19df2e235 100644 --- a/.github/workflows/ftk-pr-cleanup.yml +++ b/.github/workflows/ftk-pr-cleanup.yml @@ -27,7 +27,7 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion 6.16.2 -Force - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/ftk-pr-deploy.yml b/.github/workflows/ftk-pr-deploy.yml index d4e2a33ae..1393f0812 100644 --- a/.github/workflows/ftk-pr-deploy.yml +++ b/.github/workflows/ftk-pr-deploy.yml @@ -133,7 +133,7 @@ jobs: steps: - name: Restore Az modules id: az-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /home/runner/.local/share/powershell/Modules key: az-modules-${{ env.AZ_ACCOUNTS_VERSION }}-${{ env.AZ_RESOURCES_VERSION }}-${{ env.AZ_STORAGE_VERSION }} @@ -147,12 +147,12 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion $env:AZ_RESOURCES_VERSION -Force Install-Module -Name Az.Storage -RequiredVersion $env:AZ_STORAGE_VERSION -Force - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.head.sha }} - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -198,7 +198,7 @@ jobs: - name: Restore Az modules id: az-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /home/runner/.local/share/powershell/Modules key: az-modules-${{ env.AZ_ACCOUNTS_VERSION }}-${{ env.AZ_RESOURCES_VERSION }}-${{ env.AZ_STORAGE_VERSION }} @@ -212,12 +212,12 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion $env:AZ_RESOURCES_VERSION -Force Install-Module -Name Az.Storage -RequiredVersion $env:AZ_STORAGE_VERSION -Force - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.head.sha }} - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -257,7 +257,7 @@ jobs: steps: - name: Restore Az modules id: az-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /home/runner/.local/share/powershell/Modules key: az-modules-${{ env.AZ_ACCOUNTS_VERSION }}-${{ env.AZ_RESOURCES_VERSION }}-${{ env.AZ_STORAGE_VERSION }} @@ -271,12 +271,12 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion $env:AZ_RESOURCES_VERSION -Force Install-Module -Name Az.Storage -RequiredVersion $env:AZ_STORAGE_VERSION -Force - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.head.sha }} - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -313,7 +313,7 @@ jobs: steps: - name: Restore Az modules id: az-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /home/runner/.local/share/powershell/Modules key: az-modules-${{ env.AZ_ACCOUNTS_VERSION }}-${{ env.AZ_RESOURCES_VERSION }}-${{ env.AZ_STORAGE_VERSION }} @@ -327,12 +327,12 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion $env:AZ_RESOURCES_VERSION -Force Install-Module -Name Az.Storage -RequiredVersion $env:AZ_STORAGE_VERSION -Force - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.head.sha }} - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -372,7 +372,7 @@ jobs: steps: - name: Restore Az modules id: az-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /home/runner/.local/share/powershell/Modules key: az-modules-${{ env.AZ_ACCOUNTS_VERSION }}-${{ env.AZ_RESOURCES_VERSION }}-${{ env.AZ_STORAGE_VERSION }} @@ -386,12 +386,12 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion $env:AZ_RESOURCES_VERSION -Force Install-Module -Name Az.Storage -RequiredVersion $env:AZ_STORAGE_VERSION -Force - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.head.sha }} - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -428,7 +428,7 @@ jobs: steps: - name: Restore Az modules id: az-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /home/runner/.local/share/powershell/Modules key: az-modules-${{ env.AZ_ACCOUNTS_VERSION }}-${{ env.AZ_RESOURCES_VERSION }}-${{ env.AZ_STORAGE_VERSION }} @@ -442,12 +442,12 @@ jobs: Install-Module -Name Az.Resources -RequiredVersion $env:AZ_RESOURCES_VERSION -Force Install-Module -Name Az.Storage -RequiredVersion $env:AZ_STORAGE_VERSION -Force - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.event.pull_request.head.sha }} - name: Azure login - uses: azure/login@v2 + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/opendata-ci.yml b/.github/workflows/opendata-ci.yml index f1f4afa80..70896da23 100644 --- a/.github/workflows/opendata-ci.yml +++ b/.github/workflows/opendata-ci.yml @@ -18,7 +18,7 @@ jobs: CI_COMMIT_MESSAGE: Generate PowerShell commands for open data CI_COMMIT_AUTHOR: Open Data CI steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: ref: ${{ github.event.pull_request.head.ref }} - name: Set environment variable "commit-message" @@ -47,7 +47,7 @@ jobs: shell: pwsh run: | src/scripts/Build-OpenData.ps1 -Test - - uses: actions/github-script@v7 + - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 if: failure() with: github-token: ${{secrets.GITHUB_TOKEN}} diff --git a/.github/workflows/opendata-commitment-eligibility.yml b/.github/workflows/opendata-commitment-eligibility.yml index d896e0e5f..78d91a36c 100644 --- a/.github/workflows/opendata-commitment-eligibility.yml +++ b/.github/workflows/opendata-commitment-eligibility.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: dev diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f7efcbb72..256483fec 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,11 +7,11 @@ jobs: runs-on: windows-latest steps: - name: Install and cache PowerShell modules - uses: potatoqualitee/psmodulecache@v6.2.1 + uses: potatoqualitee/psmodulecache@ee5e9494714abf56f6efbfa51527b2aec5c761b8 # v6.2.1 with: modules-to-cache: InvokeBuild, PSScriptAnalyzer, Pester, Az.Accounts, Az.Resources shell: pwsh - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: PowerShellGallery shell: pwsh run: ./.build/start.ps1 -Task Publish.PsModule -ApiKey ${{ secrets.POWERSHELLGALLERY }} diff --git a/.github/workflows/update-mslearn-dates.yml b/.github/workflows/update-mslearn-dates.yml index 0e854b362..6e79deeea 100644 --- a/.github/workflows/update-mslearn-dates.yml +++ b/.github/workflows/update-mslearn-dates.yml @@ -17,7 +17,7 @@ jobs: if: github.event.pull_request.head.repo.full_name == github.repository steps: - name: Checkout PR branch - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.head_ref }} fetch-depth: 0 @@ -25,7 +25,7 @@ jobs: - name: Get changed markdown files id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5 with: files: 'docs-mslearn/**/*.md' diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 6d4f0ea5a..ac537ca92 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -27,13 +27,13 @@ jobs: steps: - name: Checkout Source Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: ${{ env.wiki_source_repo }} path: ${{ env.wiki_source_repo }} - name: Checkout Wiki Repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: ${{ env.wiki_target_repo }} path: ${{ env.wiki_target_repo }} From 4cb678bb4baf8ec0ea674c3d7c31dfe09ed7c5c6 Mon Sep 17 00:00:00 2001 From: MSBrett Date: Wed, 12 Aug 2026 08:21:16 -0700 Subject: [PATCH 2/2] fix: pin Azure login action Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/aoe-cd-dev.yml | 2 +- .github/workflows/aoe-cd-prod.yml | 2 +- .github/workflows/aoe-cd-test.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/aoe-cd-dev.yml b/.github/workflows/aoe-cd-dev.yml index 43b80bb3c..3645a9e17 100644 --- a/.github/workflows/aoe-cd-dev.yml +++ b/.github/workflows/aoe-cd-dev.yml @@ -34,7 +34,7 @@ jobs: - name: Check out repository code uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Login via Az module - uses: azure/login@hf_447_release + uses: azure/login@264ef4588d3ca547fea5296679ee9f8a4766d4df # hf_447_release with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/aoe-cd-prod.yml b/.github/workflows/aoe-cd-prod.yml index 7f51f0810..dc441cd01 100644 --- a/.github/workflows/aoe-cd-prod.yml +++ b/.github/workflows/aoe-cd-prod.yml @@ -34,7 +34,7 @@ jobs: - name: Check out repository code uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Login via Az module - uses: azure/login@hf_447_release + uses: azure/login@264ef4588d3ca547fea5296679ee9f8a4766d4df # hf_447_release with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/aoe-cd-test.yml b/.github/workflows/aoe-cd-test.yml index cb6afcb1c..ae78ee110 100644 --- a/.github/workflows/aoe-cd-test.yml +++ b/.github/workflows/aoe-cd-test.yml @@ -34,7 +34,7 @@ jobs: - name: Check out repository code uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Login via Az module - uses: azure/login@hf_447_release + uses: azure/login@264ef4588d3ca547fea5296679ee9f8a4766d4df # hf_447_release with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }}