From 1933810db2f61ec3c07f1c143913449f6d13e50a Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 20:49:02 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ ...nfirm-policy-definition-no-built-in-conflicts.yaml | 4 ++-- .../workflows/confirm-policy-definition-validity.yaml | 4 ++-- .github/workflows/manage-azure-policy-1e59415b.yml | 6 +++--- 4 files changed, 18 insertions(+), 7 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/confirm-policy-definition-no-built-in-conflicts.yaml b/.github/workflows/confirm-policy-definition-no-built-in-conflicts.yaml index 4ad81229..511f74f9 100644 --- a/.github/workflows/confirm-policy-definition-no-built-in-conflicts.yaml +++ b/.github/workflows/confirm-policy-definition-no-built-in-conflicts.yaml @@ -17,11 +17,11 @@ jobs: permissions: pull-requests: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Get changed files id: changed_files - uses: tj-actions/changed-files@v45.0.8 + uses: tj-actions/changed-files@a284dc1814e3fd07f2e34267fc8f81227ed29fb8 # v45.0.8 with: separator: "§" # we need a character which isn't used within a file name or path diff --git a/.github/workflows/confirm-policy-definition-validity.yaml b/.github/workflows/confirm-policy-definition-validity.yaml index 544f0866..f34ba5d9 100644 --- a/.github/workflows/confirm-policy-definition-validity.yaml +++ b/.github/workflows/confirm-policy-definition-validity.yaml @@ -13,11 +13,11 @@ jobs: pull-requests: read steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Get changed files id: changed_files - uses: tj-actions/changed-files@v45.0.8 + uses: tj-actions/changed-files@a284dc1814e3fd07f2e34267fc8f81227ed29fb8 # v45.0.8 with: separator: "§" # Character not used within a file name or path safe_output: true # Enable safe_output for security diff --git a/.github/workflows/manage-azure-policy-1e59415b.yml b/.github/workflows/manage-azure-policy-1e59415b.yml index 369195e3..4b7ea308 100644 --- a/.github/workflows/manage-azure-policy-1e59415b.yml +++ b/.github/workflows/manage-azure-policy-1e59415b.yml @@ -19,14 +19,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Login to Azure - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: creds: ${{secrets.AZURE_CREDENTIALS_1e59415b}} allow-no-subscriptions: true - name: Create or Update Azure Policies - uses: azure/manage-azure-policy@v0 + uses: azure/manage-azure-policy@fdd67624e3b7f32cf227ffc112dca1717baf17b1 # v0 with: paths: | deploy-diagnostic-settings-to-azure-firewall/policies/Deploy_Diagnostic_Settings_for_Azure_Firewall_to_Log_Analytics_workspace_855bd88d-18bf-42c2-a519-9e7798bb7ee4/**