From e501ac225f3287653bad65669c57fce31387d478 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Sat, 5 Sep 2026 20:11:51 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                                | 11 +++++++++++
 .github/workflows/packages.yml                        |  4 ++--
 ...oyTrigger-cd1d418e-9e7d-4855-bcfa-dc4948f26827.yml |  6 +++---
 ...oyTrigger-f3913371-eedb-47f9-b97b-efa659b130a7.yml |  6 +++---
 .github/workflows/template.yml                        |  2 +-
 5 files changed, 20 insertions(+), 9 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index df40357..0d4cf34 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -12,11 +12,11 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Create packages
         run: ./scripts/repo/create-packages.sh
       - name: Update release
-        uses: ncipollo/release-action@v1.12.0
+        uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # v1.12.0
         with:
           name: Workshop packages
           tag: latest
diff --git a/.github/workflows/quarkus-native-monitoring-AutoDeployTrigger-cd1d418e-9e7d-4855-bcfa-dc4948f26827.yml b/.github/workflows/quarkus-native-monitoring-AutoDeployTrigger-cd1d418e-9e7d-4855-bcfa-dc4948f26827.yml
index 140e3b0..48132fe 100644
--- a/.github/workflows/quarkus-native-monitoring-AutoDeployTrigger-cd1d418e-9e7d-4855-bcfa-dc4948f26827.yml
+++ b/.github/workflows/quarkus-native-monitoring-AutoDeployTrigger-cd1d418e-9e7d-4855-bcfa-dc4948f26827.yml
@@ -22,17 +22,17 @@ jobs:
 
     steps:
       - name: Checkout to the branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Azure Login
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           client-id: ${{ secrets.QUARKUSNATIVEMONITORING_AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.QUARKUSNATIVEMONITORING_AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.QUARKUSNATIVEMONITORING_AZURE_SUBSCRIPTION_ID }}
 
       - name: Build and push container image to registry
-        uses: azure/container-apps-deploy-action@v2
+        uses: azure/container-apps-deploy-action@8dff69dac3367c32ceb2690d8f13adbeab462703 # v2
         with:
           appSourcePath: ${{ github.workspace }}/code/quarkus-telemetry/quarkus-telemetry-superhero/
           registryUrl: nativetelemetry.azurecr.io
diff --git a/.github/workflows/spring-native-otel-AutoDeployTrigger-f3913371-eedb-47f9-b97b-efa659b130a7.yml b/.github/workflows/spring-native-otel-AutoDeployTrigger-f3913371-eedb-47f9-b97b-efa659b130a7.yml
index 4aa32a6..4267bf3 100644
--- a/.github/workflows/spring-native-otel-AutoDeployTrigger-f3913371-eedb-47f9-b97b-efa659b130a7.yml
+++ b/.github/workflows/spring-native-otel-AutoDeployTrigger-f3913371-eedb-47f9-b97b-efa659b130a7.yml
@@ -22,17 +22,17 @@ jobs:
 
     steps:
       - name: Checkout to the branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Azure Login
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           client-id: ${{ secrets.SPRINGNATIVEOTEL_AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.SPRINGNATIVEOTEL_AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.SPRINGNATIVEOTEL_AZURE_SUBSCRIPTION_ID }}
 
       - name: Build and push container image to registry
-        uses: azure/container-apps-deploy-action@v2
+        uses: azure/container-apps-deploy-action@8dff69dac3367c32ceb2690d8f13adbeab462703 # v2
         with:
           appSourcePath: ${{ github.workspace }}/code/spring-boot-telemetry
           registryUrl: nativetelemetry.azurecr.io
diff --git a/.github/workflows/template.yml b/.github/workflows/template.yml
index cc4a5a7..3fcd1a6 100644
--- a/.github/workflows/template.yml
+++ b/.github/workflows/template.yml
@@ -12,7 +12,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Update template
         run: |
           git config --global user.name "ci-rebot"