[Rick Brighenti (rbrighenti)]

Summary

Pins every GitHub Actions uses: reference in this repo to a full-length (40-character) commit SHA with a trailing version comment, and adds a Dependabot github-actions config to keep the pins up to date. This is Microsoft's upcoming GitHub requirement: https://aka.ms/action-pinning.

Replaces #264, which was opened from a fork and closed without merging. This branch is in microsoft/Agent365-dotnet, so CI gets the repo secrets and variables it needs (AZURE_OPENAI_*).

Pinned actions

Action	Before	After	Used in
actions/checkout	@v4	@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0	ci.yml, dependency-review.yml
actions/setup-dotnet	@v4	@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1	ci.yml
actions/upload-artifact	@v4	@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2	ci.yml
actions/dependency-review-action	@v4	@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0	dependency-review.yml

Each action stays on its current major version and is pinned to the commit of the latest release in that major. I resolved each SHA from the action's own repo. All four release tags are lightweight tags that point directly at commits. Each SHA is also the commit that @v4 resolves to today, so action behavior doesn't change.

Dependabot

New .github/dependabot.yml with weekly github-actions updates, grouped into a single PR. It sets cooldown.default-days: 7, so a new release isn't proposed until it has been public for a week. This config matches the other A365 repos: microsoft/Agent365-python#277, microsoft/Agent365-nodejs#309, microsoft/Agent365-devTools#506, microsoft/Agent365-Samples#342 and microsoft/agent365-skills#79.

How to verify

gh api repos/actions/checkout/commits/v4.4.0 --jq .sha returns the pinned SHA. The same check works for the other tags.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	11d5960a326750d5838078e36cf38b85af677262	🟢 5.9	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits
actions/actions/dependency-review-action	2031cfc080254a8a887f58cffee85186f0e49e48	🟢 7.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 9 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/dependency-review.yml

[Copilot]

🟢 Approval recommended

The pins match upstream releases, and no blocking issues remain in the workflow or Dependabot changes.

No open issues 🎉

What changed in this PR

Hardens the SDK’s CI workflows by replacing mutable action tags with commit pins and automating pin updates.

Changes:

• Pins all five action references to full-length SHAs with version comments.
• Adds grouped weekly Dependabot updates with a seven-day cooldown.

File	Description
.github/​workflows/​dependency-review.yml	Pins checkout and dependency-review actions.
.github/​workflows/​ci.yml	Pins checkout, .NET setup, and artifact upload actions.
.github/​dependabot.yml	Configures grouped weekly action updates and cooldown.

_{Review effort: Balanced}