From c33b6e73932bed253fac4339fe97803f331619bc Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 19 Aug 2026 09:05:15 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/actions/build-with-host/action.yml     |  4 ++--
 .github/actions/build-with-selfhost/action.yml |  2 +-
 .github/dependabot.yml                         | 11 +++++++++++
 .github/workflows/build.yml                    |  6 +++---
 4 files changed, 17 insertions(+), 6 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/actions/build-with-host/action.yml b/.github/actions/build-with-host/action.yml
index aa3065bf..3d05cceb 100644
--- a/.github/actions/build-with-host/action.yml
+++ b/.github/actions/build-with-host/action.yml
@@ -34,7 +34,7 @@ runs:
   using: 'composite'
   steps:
   - name: Configure vcpkg to use Github Actions Cache 
-    uses: actions/github-script@v7
+    uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
     with:
       script: |
         core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
@@ -86,7 +86,7 @@ runs:
 
   - name: Publish Artifacts
     if: inputs.publish-artifacts == 'true'
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
     with:
       name: release-package-${{ runner.os }}-${{ inputs.build-type }}-${{ inputs.arch != '' && inputs.arch || runner.arch }}
       path: |
diff --git a/.github/actions/build-with-selfhost/action.yml b/.github/actions/build-with-selfhost/action.yml
index ad715bea..c5b6c411 100644
--- a/.github/actions/build-with-selfhost/action.yml
+++ b/.github/actions/build-with-selfhost/action.yml
@@ -61,7 +61,7 @@ runs:
 
   - name: Publish Artifacts
     if: inputs.publish-artifacts == 'true'
-    uses: actions/upload-artifact@v3
+    uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
     with:
       name: release-package-${{ runner.os }}-${{ inputs.build-type }}-${{ inputs.arch != '' && inputs.arch || runner.arch }}
       path: |
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c9cdca48..5f119bab 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -108,11 +108,11 @@ jobs:
  
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Initialize CodeQL
       if: inputs.analyze-codeql == true
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
       with:
         languages: 'cpp'
 
@@ -142,4 +142,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: inputs.analyze-codeql == true
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7