From 35bff550256395dc952f34d44ae52aeb4676ae9c Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Tue, 4 Aug 2026 09:34:11 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 ++++ .github/workflows/daily-release.yaml | 12 ++--- .../download-localization-strings.yml | 6 +-- .github/workflows/playground.yaml | 6 +-- .github/workflows/preview-branch.yml | 24 ++++----- .github/workflows/publish-github-pages.yaml | 8 +-- .github/workflows/pull-request-validation.yml | 54 +++++++++---------- .../samples.07.a.upload-to-azure-storage.yaml | 6 +-- .../samples.07.b.sso-for-enterprise.yaml | 6 +-- .../samples.07.c.sso-for-intranet.yaml | 6 +-- .../workflows/samples.07.d.sso-for-teams.yaml | 6 +-- 11 files changed, 78 insertions(+), 67 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..2c48305b7e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/daily-release.yaml b/.github/workflows/daily-release.yaml index a06dbad31b..32f5bddcc9 100644 --- a/.github/workflows/daily-release.yaml +++ b/.github/workflows/daily-release.yaml @@ -23,10 +23,10 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -75,7 +75,7 @@ jobs: cp *.tgz ../../artifacts/tarballs - name: Upload bundles - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: bundles path: | @@ -83,7 +83,7 @@ jobs: packages/bundle/stable/**/* - name: Upload tarballs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: tarballs path: artifacts/tarballs/**/* @@ -96,11 +96,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: bundles - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: tarballs diff --git a/.github/workflows/download-localization-strings.yml b/.github/workflows/download-localization-strings.yml index 26096b30c4..672cddeda6 100644 --- a/.github/workflows/download-localization-strings.yml +++ b/.github/workflows/download-localization-strings.yml @@ -24,7 +24,7 @@ jobs: curl --fail --output localization-files/$locale.json --user ${{ secrets.ADO_USERNAME }}:${{ secrets.ADO_TOKEN }} https://dev.azure.com/bagie/Production/_apis/git/repositories/D365_CE/items?api-version=7.0\&download=true\&path=/Feature/CustomerCare_Apps/UI/$locale/BotFramework-WebChat/packages/api/src/Localization/$locale.json done - - uses: actions/upload-artifact@v3 + - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1 with: name: localization-files path: localization-files/ @@ -39,9 +39,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3.3.0 + - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - - uses: actions/download-artifact@v3 + - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 with: name: localization-files path: packages/api/src/localization diff --git a/.github/workflows/playground.yaml b/.github/workflows/playground.yaml index 26d089f192..b2c28eda71 100644 --- a/.github/workflows/playground.yaml +++ b/.github/workflows/playground.yaml @@ -14,7 +14,7 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - run: npm clean-install --ignore-scripts @@ -31,13 +31,13 @@ jobs: env: NODE_ENV: production - - uses: actions/upload-artifact@v2 + - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: wwwroot path: packages/playground/build.zip - id: deploy - uses: azure/webapps-deploy@v2.1.2 + uses: azure/webapps-deploy@2d85376f88b09cd11575b3d7e96b65c3effe5e05 # v2.1.2 with: app-name: webchat-playground slot-name: production diff --git a/.github/workflows/preview-branch.yml b/.github/workflows/preview-branch.yml index dba30ee791..cad0ba5291 100644 --- a/.github/workflows/preview-branch.yml +++ b/.github/workflows/preview-branch.yml @@ -14,10 +14,10 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v1 + uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: ${{ matrix.node-version }} @@ -58,7 +58,7 @@ jobs: npm pack - name: Upload bundle - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: bundle path: | @@ -66,7 +66,7 @@ jobs: packages/bundle/stable/**/* - name: Upload npm-tarball - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: npm-tarball path: 'packages/*/*.tgz' @@ -77,18 +77,18 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 with: path: repo - name: Download bundle - uses: actions/download-artifact@v2 + uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2.1.1 with: name: bundle path: artifacts/bundle - name: Download npm-tarball - uses: actions/download-artifact@v2 + uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2.1.1 with: name: npm-tarball path: artifacts/npm-tarball @@ -126,7 +126,7 @@ jobs: git push origin ${{ steps.variables.outputs.tag_name }} - name: Create a release - uses: actions/create-release@v1 + uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 id: create-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -188,7 +188,7 @@ jobs: ``` - name: Upload webchat.js to release - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -198,7 +198,7 @@ jobs: asset_content_type: text/javascript - name: Upload webchat-es5.js to release - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -208,7 +208,7 @@ jobs: asset_content_type: text/javascript - name: Upload webchat-minimal.js to release - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -218,7 +218,7 @@ jobs: asset_content_type: text/javascript - name: Upload stats.json to release - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/publish-github-pages.yaml b/.github/workflows/publish-github-pages.yaml index 8ed0187a77..a6e16d5ea1 100644 --- a/.github/workflows/publish-github-pages.yaml +++ b/.github/workflows/publish-github-pages.yaml @@ -22,10 +22,10 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -105,7 +105,7 @@ jobs: rsync -av --progress samples/06.recomposing-ui/e.extending-ui/public/ gh-pages/06.recomposing-ui/e.extending-ui/ - name: Upload pages artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: gh-pages @@ -124,4 +124,4 @@ jobs: steps: - id: deployment name: Deploy to GitHub Pages - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/pull-request-validation.yml b/.github/workflows/pull-request-validation.yml index 370f51e8ee..243a974d7e 100644 --- a/.github/workflows/pull-request-validation.yml +++ b/.github/workflows/pull-request-validation.yml @@ -33,10 +33,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -76,7 +76,7 @@ jobs: - run: ls -l docker.zip - name: Upload Docker artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: compression-level: 0 name: docker @@ -89,7 +89,7 @@ jobs: - name: Tar all tarballs run: find . -type f -name '*.tgz' -not -path '*/node_modules/*' -print0 | tar --null -cvf tarballs.tar --files-from=- - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: compression-level: 0 name: tarballs @@ -107,10 +107,10 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -124,10 +124,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -145,10 +145,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -156,7 +156,7 @@ jobs: - run: npm clean-install --strict-peer-deps - name: Download tarballs - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: tarballs @@ -175,10 +175,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -186,7 +186,7 @@ jobs: - run: npm clean-install --strict-peer-deps - name: Download tarballs - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: tarballs @@ -223,7 +223,7 @@ jobs: - if: always() name: Upload test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: test-result-unit path: | @@ -237,10 +237,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm @@ -248,7 +248,7 @@ jobs: - run: npm clean-install --strict-peer-deps - name: Download tarballs - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: tarballs @@ -289,12 +289,12 @@ jobs: steps: - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} - name: Download Docker artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: docker @@ -351,7 +351,7 @@ jobs: - if: always() name: Upload test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: test-result-html-${{ matrix.shard-index }} path: | @@ -360,7 +360,7 @@ jobs: - if: failure() name: Upload test snapshot diffs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: compression-level: 0 name: test-snapshot-diff-html-${{ matrix.shard-index }} @@ -378,14 +378,14 @@ jobs: steps: - name: Merge test result artifacts - uses: actions/upload-artifact/merge@v4 + uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: delete-merged: true name: test-result pattern: test-result-* - name: Download test results - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: test-result @@ -416,7 +416,7 @@ jobs: steps: - continue-on-error: true # Do not error out when no artifacts to merge, see https://github.com/actions/upload-artifact/issues/524 name: Merge test snapshots artifacts - uses: actions/upload-artifact/merge@v4 + uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: compression-level: 0 delete-merged: true @@ -431,12 +431,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - run: git fetch origin main - name: Use Node.js ${{ env.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.node-version }} cache: npm diff --git a/.github/workflows/samples.07.a.upload-to-azure-storage.yaml b/.github/workflows/samples.07.a.upload-to-azure-storage.yaml index 80b358b855..0e8852e0d7 100644 --- a/.github/workflows/samples.07.a.upload-to-azure-storage.yaml +++ b/.github/workflows/samples.07.a.upload-to-azure-storage.yaml @@ -25,14 +25,14 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Read variables id: variables run: | echo "::set-output name=short_sha::${GITHUB_SHA:0:7}" - - uses: azure/docker-login@v1 + - uses: azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1 with: login-server: ${{ env.DOCKER_REGISTRY }} username: ${{ secrets.SAMPLES_DOCKER_USERNAME }} @@ -49,7 +49,7 @@ jobs: docker push ${{ env.DOCKER_IMAGE }}:latest docker push ${{ env.DOCKER_IMAGE }}:${{ env.DOCKER_TAG }} - - uses: actions/upload-artifact@v2 + - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: build path: ${{ env.DOCKERFILE_PATH }}/build.tgz diff --git a/.github/workflows/samples.07.b.sso-for-enterprise.yaml b/.github/workflows/samples.07.b.sso-for-enterprise.yaml index 33a2df6da0..7c926bf9ba 100644 --- a/.github/workflows/samples.07.b.sso-for-enterprise.yaml +++ b/.github/workflows/samples.07.b.sso-for-enterprise.yaml @@ -25,14 +25,14 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Read variables id: variables run: | echo "::set-output name=short_sha::${GITHUB_SHA:0:7}" - - uses: azure/docker-login@v1 + - uses: azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1 with: login-server: ${{ env.DOCKER_REGISTRY }} username: ${{ secrets.SAMPLES_DOCKER_USERNAME }} @@ -49,7 +49,7 @@ jobs: docker push ${{ env.DOCKER_IMAGE }}:latest docker push ${{ env.DOCKER_IMAGE }}:${{ env.DOCKER_TAG }} - - uses: actions/upload-artifact@v2 + - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: build path: ${{ env.DOCKERFILE_PATH }}/build.tgz diff --git a/.github/workflows/samples.07.c.sso-for-intranet.yaml b/.github/workflows/samples.07.c.sso-for-intranet.yaml index e91b412e46..514f30c61d 100644 --- a/.github/workflows/samples.07.c.sso-for-intranet.yaml +++ b/.github/workflows/samples.07.c.sso-for-intranet.yaml @@ -25,14 +25,14 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Read variables id: variables run: | echo "::set-output name=short_sha::${GITHUB_SHA:0:7}" - - uses: azure/docker-login@v1 + - uses: azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1 with: login-server: ${{ env.DOCKER_REGISTRY }} username: ${{ secrets.SAMPLES_DOCKER_USERNAME }} @@ -49,7 +49,7 @@ jobs: docker push ${{ env.DOCKER_IMAGE }}:latest docker push ${{ env.DOCKER_IMAGE }}:${{ env.DOCKER_TAG }} - - uses: actions/upload-artifact@v2 + - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: build path: ${{ env.DOCKERFILE_PATH }}/build.tgz diff --git a/.github/workflows/samples.07.d.sso-for-teams.yaml b/.github/workflows/samples.07.d.sso-for-teams.yaml index 577c747335..0145a2787b 100644 --- a/.github/workflows/samples.07.d.sso-for-teams.yaml +++ b/.github/workflows/samples.07.d.sso-for-teams.yaml @@ -25,14 +25,14 @@ jobs: steps: - name: Checking out for ${{ github.ref }} - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Read variables id: variables run: | echo "::set-output name=short_sha::${GITHUB_SHA:0:7}" - - uses: azure/docker-login@v1 + - uses: azure/docker-login@83efeb77770c98b620c73055fbb59b2847e17dc0 # v1.0.1 with: login-server: ${{ env.DOCKER_REGISTRY }} username: ${{ secrets.SAMPLES_DOCKER_USERNAME }} @@ -49,7 +49,7 @@ jobs: docker push ${{ env.DOCKER_IMAGE }}:latest docker push ${{ env.DOCKER_IMAGE }}:${{ env.DOCKER_TAG }} - - uses: actions/upload-artifact@v2 + - uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1 with: name: build path: ${{ env.DOCKERFILE_PATH }}/build.tgz