From c0de59058c581d44302a2a8b8768a59df5f579e7 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 16:30:00 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/codeql.yml | 8 ++++---- .github/workflows/docs-examples.yml | 16 ++++++++-------- .github/workflows/hygiene.yml | 2 +- .github/workflows/prompty-csharp-check.yml | 4 ++-- .github/workflows/prompty-csharp.yml | 6 +++--- .github/workflows/prompty-python-check.yml | 10 +++++----- .github/workflows/prompty-python.yml | 8 ++++---- .github/workflows/prompty-rust-check.yml | 4 ++-- .github/workflows/prompty-rust.yml | 2 +- .github/workflows/prompty-ts-check.yml | 4 ++-- .github/workflows/prompty-ts-release.yml | 4 ++-- .github/workflows/prompty-vscode-check.yml | 4 ++-- .github/workflows/prompty-vscode.yml | 6 +++--- .github/workflows/web-deploy.yml | 6 +++--- 15 files changed, 53 insertions(+), 42 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1e0bcfd22..4c863e28f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,18 +36,18 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: languages: ${{ matrix.language }} - name: Autobuild if: matrix.language == 'csharp' || matrix.language == 'go' || matrix.language == 'rust' - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: category: /language:${{ matrix.language }} diff --git a/.github/workflows/docs-examples.yml b/.github/workflows/docs-examples.yml index 3770fac51..885bc8c1c 100644 --- a/.github/workflows/docs-examples.yml +++ b/.github/workflows/docs-examples.yml @@ -15,10 +15,10 @@ jobs: name: Python examples runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up Python 3.11 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.11' @@ -44,9 +44,9 @@ jobs: run: working-directory: web/docs-examples/typescript steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24 @@ -64,10 +64,10 @@ jobs: name: C# examples runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup dotnet 9.0 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: '9.0.x' @@ -82,9 +82,9 @@ jobs: run: working-directory: web steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24 diff --git a/.github/workflows/hygiene.yml b/.github/workflows/hygiene.yml index 0b81d7c48..1b549d048 100644 --- a/.github/workflows/hygiene.yml +++ b/.github/workflows/hygiene.yml @@ -14,7 +14,7 @@ jobs: name: line endings and whitespace runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 2 diff --git a/.github/workflows/prompty-csharp-check.yml b/.github/workflows/prompty-csharp-check.yml index c17bf02f4..2f2ab3451 100644 --- a/.github/workflows/prompty-csharp-check.yml +++ b/.github/workflows/prompty-csharp-check.yml @@ -19,9 +19,9 @@ jobs: dotnet-version: [ '9.0.x' ] os: [ubuntu-latest, macOS-latest, windows-latest] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup dotnet ${{ matrix.dotnet-version }} - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: ${{ matrix.dotnet-version }} diff --git a/.github/workflows/prompty-csharp.yml b/.github/workflows/prompty-csharp.yml index a6b017213..fa046475c 100644 --- a/.github/workflows/prompty-csharp.yml +++ b/.github/workflows/prompty-csharp.yml @@ -22,9 +22,9 @@ jobs: id-token: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup dotnet - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: '9.0.x' @@ -49,7 +49,7 @@ jobs: run: dotnet pack --configuration Release --no-restore --output ./artifacts - name: NuGet login (OIDC trusted publishing) - uses: NuGet/login@v1 + uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0 id: nuget-login with: user: ${{ secrets.NUGET_USER }} diff --git a/.github/workflows/prompty-python-check.yml b/.github/workflows/prompty-python-check.yml index b63681dc2..f263cc6ec 100644 --- a/.github/workflows/prompty-python-check.yml +++ b/.github/workflows/prompty-python-check.yml @@ -28,10 +28,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} @@ -60,7 +60,7 @@ jobs: needs: prompty-v2-tests steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Create timestamp tag run: | @@ -73,7 +73,7 @@ jobs: cat ./prompty/_version.py - name: Set up Python 3.11 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.11' @@ -91,7 +91,7 @@ jobs: flit build --format wheel flit build --format sdist - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: prompty-v2-artifacts path: ./runtime/python/prompty/dist/* diff --git a/.github/workflows/prompty-python.yml b/.github/workflows/prompty-python.yml index 2b70ecb0f..e87fae7a8 100644 --- a/.github/workflows/prompty-python.yml +++ b/.github/workflows/prompty-python.yml @@ -14,10 +14,10 @@ jobs: name: release check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Set up Python 3.11 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.11' @@ -51,7 +51,7 @@ jobs: id-token: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Verify tag matches source version working-directory: ./runtime/python/prompty @@ -66,7 +66,7 @@ jobs: echo "VERSION=$TAG_VERSION" >> "$GITHUB_ENV" - name: Set up Python 3.11 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.11' diff --git a/.github/workflows/prompty-rust-check.yml b/.github/workflows/prompty-rust-check.yml index 5db35f479..636ba75f0 100644 --- a/.github/workflows/prompty-rust-check.yml +++ b/.github/workflows/prompty-rust-check.yml @@ -22,7 +22,7 @@ jobs: run: working-directory: runtime/rust steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@master @@ -31,7 +31,7 @@ jobs: components: rustfmt, clippy - name: Cache cargo registry & build - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.cargo/registry diff --git a/.github/workflows/prompty-rust.yml b/.github/workflows/prompty-rust.yml index cc6539b30..f8ef9b0e8 100644 --- a/.github/workflows/prompty-rust.yml +++ b/.github/workflows/prompty-rust.yml @@ -24,7 +24,7 @@ jobs: run: working-directory: runtime/rust steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable diff --git a/.github/workflows/prompty-ts-check.yml b/.github/workflows/prompty-ts-check.yml index 145a0ce7c..13829287c 100644 --- a/.github/workflows/prompty-ts-check.yml +++ b/.github/workflows/prompty-ts-check.yml @@ -23,8 +23,8 @@ jobs: run: working-directory: runtime/typescript steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node }} - run: npm ci diff --git a/.github/workflows/prompty-ts-release.yml b/.github/workflows/prompty-ts-release.yml index 86c0f4ad0..651a0e024 100644 --- a/.github/workflows/prompty-ts-release.yml +++ b/.github/workflows/prompty-ts-release.yml @@ -21,8 +21,8 @@ jobs: run: working-directory: runtime/typescript steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 24 # Ships npm 11+ natively (OIDC trusted publishing) registry-url: https://registry.npmjs.org diff --git a/.github/workflows/prompty-vscode-check.yml b/.github/workflows/prompty-vscode-check.yml index 672acba9a..f2a8b9c1e 100644 --- a/.github/workflows/prompty-vscode-check.yml +++ b/.github/workflows/prompty-vscode-check.yml @@ -22,10 +22,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" diff --git a/.github/workflows/prompty-vscode.yml b/.github/workflows/prompty-vscode.yml index 136827b7b..d7b161229 100644 --- a/.github/workflows/prompty-vscode.yml +++ b/.github/workflows/prompty-vscode.yml @@ -15,10 +15,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" @@ -58,7 +58,7 @@ jobs: working-directory: ./vscode/prompty run: npm run package-pre -- "$VERSION" --no-update-package-json --out "prompty-${VSIX_TIMESTAMP}.vsix" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: prompty-vsix-${{ env.VSIX_TIMESTAMP }} path: ./vscode/prompty/prompty-${{ env.VSIX_TIMESTAMP }}.vsix diff --git a/.github/workflows/web-deploy.yml b/.github/workflows/web-deploy.yml index 0a985ce44..2e4122a75 100644 --- a/.github/workflows/web-deploy.yml +++ b/.github/workflows/web-deploy.yml @@ -10,7 +10,7 @@ jobs: build-and-deploy-web: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Create tag run: | TAG="v$(TZ='America/Los_Angeles' date +%Y%m%d.%H%M%S)" @@ -18,14 +18,14 @@ jobs: echo "Using tag: $TAG" - name: Log in to Azure - uses: azure/login@v3 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Log in to registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ secrets.REGISTRY_ENDPOINT }} username: ${{ secrets.REGISTRY_USERNAME }}