From e7eba873d98f866d3f1a53810cb5de4b8ecb46f1 Mon Sep 17 00:00:00 2001 From: "Prekshith DJ (Persistent Systems Limited)" Date: Fri, 14 Aug 2026 12:26:35 +0530 Subject: [PATCH] Pin GitHub Actions to commit SHAs --- .github/workflows/agnext-biab-02-containerimage.yml | 8 ++++---- .github/workflows/azd-template-validation.yml | 4 ++-- .github/workflows/azure-dev.yml | 6 +++--- .github/workflows/broken-links-checker.yml | 6 +++--- .github/workflows/codeql.yml | 6 +++--- .github/workflows/deploy-waf.yml | 4 ++-- .github/workflows/deploy.yml | 6 +++--- .github/workflows/docker-build-and-push.yml | 12 ++++++------ .github/workflows/job-cleanup-deployment.yml | 2 +- .github/workflows/job-deploy-linux.yml | 8 ++++---- .github/workflows/job-deploy-windows.yml | 8 ++++---- .github/workflows/job-deploy.yml | 4 ++-- .github/workflows/job-docker-build.yml | 12 ++++++------ .github/workflows/pr-title-checker.yml | 2 +- .github/workflows/pylint.yml | 4 ++-- .../scheduled-Dependabot-PRs-Auto-Merge.yml | 2 +- .github/workflows/stale-bot.yml | 6 +++--- .github/workflows/telemetry-template-check.yml | 2 +- .github/workflows/test-automation-v2.yml | 8 ++++---- .github/workflows/test-automation.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- .github/workflows/validate-bicep-params.yml | 6 +++--- 22 files changed, 64 insertions(+), 64 deletions(-) diff --git a/.github/workflows/agnext-biab-02-containerimage.yml b/.github/workflows/agnext-biab-02-containerimage.yml index 15f9a794a..59f2f5dd4 100644 --- a/.github/workflows/agnext-biab-02-containerimage.yml +++ b/.github/workflows/agnext-biab-02-containerimage.yml @@ -16,26 +16,26 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # - name: Download deps # run: | # curl -fsSL ${{ vars.AUTOGEN_WHL_URL }} -o agnext-biab-02/autogen_core-0.3.dev0-py3-none-any.whl - name: Log in to the Container registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch type=sha - name: Build and push Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: agnext-biab-02/ file: agnext-biab-02/Dockerfile diff --git a/.github/workflows/azd-template-validation.yml b/.github/workflows/azd-template-validation.yml index 8b87dbb0e..cef3cd809 100644 --- a/.github/workflows/azd-template-validation.yml +++ b/.github/workflows/azd-template-validation.yml @@ -15,12 +15,12 @@ jobs: name: azd template validation environment: production steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set timestamp run: echo "HHMM=$(date -u +'%H%M')" >> $GITHUB_ENV - - uses: microsoft/template-validation-action@v0.4.4 + - uses: microsoft/template-validation-action@bae4895d0a8abd4f0d5aad68ae8647b3027f4c91 # v0.4.4 with: validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }} validateTests: ${{ vars.TEMPLATE_VALIDATE_TESTS }} diff --git a/.github/workflows/azure-dev.yml b/.github/workflows/azure-dev.yml index a73745595..c045a42de 100644 --- a/.github/workflows/azure-dev.yml +++ b/.github/workflows/azure-dev.yml @@ -23,7 +23,7 @@ jobs: AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set timestamp and env name run: | @@ -31,10 +31,10 @@ jobs: echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml index bf9a41b1c..b918b1e3a 100644 --- a/.github/workflows/broken-links-checker.yml +++ b/.github/workflows/broken-links-checker.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 @@ -34,7 +34,7 @@ jobs: - name: Check Broken Links in Changed Markdown Files id: lychee-check-pr if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true' - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --no-progress --exclude ^https?:// @@ -47,7 +47,7 @@ jobs: - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger) id: lychee-check-manual if: github.event_name == 'workflow_dispatch' - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --no-progress --exclude ^https?:// diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 56643c391..e25cb5f51 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -71,11 +71,11 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -103,6 +103,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 with: category: "/language:${{matrix.language}}" \ No newline at end of file diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml index 02c2e78a4..7a100cd3e 100644 --- a/.github/workflows/deploy-waf.yml +++ b/.github/workflows/deploy-waf.yml @@ -25,10 +25,10 @@ jobs: GPT_5_4_MIN_CAPACITY: 1 steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 8f3480e59..1bdf45eb6 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -33,10 +33,10 @@ jobs: CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -226,7 +226,7 @@ jobs: RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }} steps: - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/docker-build-and-push.yml b/.github/workflows/docker-build-and-push.yml index 5d53c14a5..d0dd77cb2 100644 --- a/.github/workflows/docker-build-and-push.yml +++ b/.github/workflows/docker-build-and-push.yml @@ -54,14 +54,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to Azure if: ${{ github.ref_name == 'main' || github.ref_name == 'dev'|| github.ref_name == 'demo-v4' || github.ref_name == 'hotfix' }} - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -103,7 +103,7 @@ jobs: echo "HISTORICAL_TAG=${{ env.TAG }}_${DATE_TAG}_${RUN_ID}" >> $GITHUB_ENV - name: Build and optionally push Backend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: ./src/backend file: ./src/backend/Dockerfile @@ -113,7 +113,7 @@ jobs: ${{ steps.registry.outputs.ext_registry }}/macaebackend:${{ env.HISTORICAL_TAG }} - name: Build and optionally push Frontend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: ./src/App file: ./src/App/Dockerfile @@ -123,7 +123,7 @@ jobs: ${{ steps.registry.outputs.ext_registry }}/macaefrontend:${{ env.HISTORICAL_TAG }} - name: Build and optionally push MCP Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: ./src/mcp_server file: ./src/mcp_server/Dockerfile diff --git a/.github/workflows/job-cleanup-deployment.yml b/.github/workflows/job-cleanup-deployment.yml index f03da25f4..e23486194 100644 --- a/.github/workflows/job-cleanup-deployment.yml +++ b/.github/workflows/job-cleanup-deployment.yml @@ -56,7 +56,7 @@ jobs: steps: - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-linux.yml b/.github/workflows/job-deploy-linux.yml index 79b4cebc6..385fde416 100644 --- a/.github/workflows/job-deploy-linux.yml +++ b/.github/workflows/job-deploy-linux.yml @@ -58,7 +58,7 @@ jobs: MACAE_URL_API: ${{ steps.get_output_linux.outputs.BACKEND_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate Workflow Input Parameters shell: bash @@ -222,10 +222,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -331,7 +331,7 @@ jobs: echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT - name: Refresh Azure login # token expires for WAF deployments due to long deployment time - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-windows.yml b/.github/workflows/job-deploy-windows.yml index 0ba7f3691..acb5f8a47 100644 --- a/.github/workflows/job-deploy-windows.yml +++ b/.github/workflows/job-deploy-windows.yml @@ -57,7 +57,7 @@ jobs: MACAE_URL_API: ${{ steps.get_output_windows.outputs.BACKEND_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate Workflow Input Parameters shell: bash @@ -221,10 +221,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -335,7 +335,7 @@ jobs: "WEBAPP_URL=$WEBAPP_URL" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append - name: Refresh Azure login # token expires for WAF deployments due to long deployment time - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy.yml b/.github/workflows/job-deploy.yml index ff38620c0..8590e706f 100644 --- a/.github/workflows/job-deploy.yml +++ b/.github/workflows/job-deploy.yml @@ -288,10 +288,10 @@ jobs: echo "Final EXP status: $EXP_ENABLED" - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-docker-build.yml b/.github/workflows/job-docker-build.yml index a39de966d..cf4b9fedc 100644 --- a/.github/workflows/job-docker-build.yml +++ b/.github/workflows/job-docker-build.yml @@ -22,7 +22,7 @@ jobs: IMAGE_TAG: ${{ steps.generate_docker_tag.outputs.IMAGE_TAG }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Generate Unique Docker Image Tag id: generate_docker_tag @@ -39,10 +39,10 @@ jobs: echo "Generated unique Docker tag: $UNIQUE_TAG" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -56,7 +56,7 @@ jobs: az acr login --name "$ACR_NAME" - name: Build and optionally push Backend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: @@ -68,7 +68,7 @@ jobs: ${{ vars.ACR_TEST_LOGIN_SERVER }}/macaebackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }} - name: Build and optionally push Frontend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: @@ -79,7 +79,7 @@ jobs: ${{ vars.ACR_TEST_LOGIN_SERVER }}/macaefrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }} ${{ vars.ACR_TEST_LOGIN_SERVER }}/macaefrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }} - name: Build and optionally push MCP Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml index 9a3090fc8..a35d5ddd8 100644 --- a/.github/workflows/pr-title-checker.yml +++ b/.github/workflows/pr-title-checker.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'merge_group' }} steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml index 62e001075..963675255 100644 --- a/.github/workflows/pylint.yml +++ b/.github/workflows/pylint.yml @@ -17,10 +17,10 @@ jobs: matrix: python-version: ["3.11"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml b/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml index e29507533..4bb09636c 100644 --- a/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml +++ b/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Install GitHub CLI run: | diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml index ea2d288f2..9abfe8581 100644 --- a/.github/workflows/stale-bot.yml +++ b/.github/workflows/stale-bot.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Mark Stale Issues and PRs - uses: actions/stale@v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: stale-issue-message: "This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or it will be closed in 30 days." stale-pr-message: "This PR is stale because it has been open 180 days with no activity. Please update or it will be closed in 30 days." @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 # Fetch full history for accurate branch checks - name: Fetch All Branches @@ -75,7 +75,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload CSV Report of Inactive Branches - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: merged-branches-report path: merged_branches_report.csv diff --git a/.github/workflows/telemetry-template-check.yml b/.github/workflows/telemetry-template-check.yml index ddf173926..2d80d8f13 100644 --- a/.github/workflows/telemetry-template-check.yml +++ b/.github/workflows/telemetry-template-check.yml @@ -14,7 +14,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Check for required metadata template line run: | diff --git a/.github/workflows/test-automation-v2.yml b/.github/workflows/test-automation-v2.yml index 6cff2a3aa..354888b5d 100644 --- a/.github/workflows/test-automation-v2.yml +++ b/.github/workflows/test-automation-v2.yml @@ -43,15 +43,15 @@ jobs: TEST_REPORT_URL: ${{ steps.upload_report.outputs.artifact-url }} steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.13' - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -138,7 +138,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ !cancelled() }} with: name: test-report diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml index 7e7b691ff..8e8db6130 100644 --- a/.github/workflows/test-automation.yml +++ b/.github/workflows/test-automation.yml @@ -40,15 +40,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" - name: Azure CLI Login - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -139,7 +139,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ !cancelled() }} with: name: test-report-${{ github.run_id }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c4b21b382..8eb9d0d31 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -46,10 +46,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.11' diff --git a/.github/workflows/validate-bicep-params.yml b/.github/workflows/validate-bicep-params.yml index 235f6ac0c..1624aff0a 100644 --- a/.github/workflows/validate-bicep-params.yml +++ b/.github/workflows/validate-bicep-params.yml @@ -24,10 +24,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.11' @@ -63,7 +63,7 @@ jobs: - name: Upload validation results if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: bicep-validation-results path: |