Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci-build.yaml

@@ -42,12 +42,12 @@ jobs:
     runs-on: ${{ github.event.inputs.RUNNER || 'windows-2022' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # FIXME: Fix cache not working
       - name: Setup PowerShell module cache
         id: cacher
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: "C:\\program files\\powershell\\7\\Modules"
           key: ${{ runner.os }}-CTK
@@ -75,7 +75,7 @@ jobs:
 
       - name: Publish PSScriptAnalyzer results file
         if: steps.code_analysis.outputs.LINTSUMMARY_EXISTS == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: PSScriptAnalyzer.Results
           path: psscriptanalysis.xml
@@ -87,12 +87,12 @@ jobs:
     runs-on: ${{ github.event.inputs.RUNNER || 'windows-2022' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # FIXME: Fix cache not working
       - name: Setup PowerShell module cache
         id: cacher
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: "C:\\program files\\powershell\\7\\Modules"
           key: ${{ runner.os }}-CTK
@@ -126,15 +126,15 @@ jobs:
             echo "$failedTestsName" >> $env:GITHUB_STEP_SUMMARY
           }
       - name: Publish Pester results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: CTK.Pester.Results
           path: ${{ env.PESTER_RESULTS_DIR }}\Test-Results.xml
           if-no-files-found: error
           overwrite: true
 
       - name: Publish code coverage results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: CTK.Coverage.Summary
           path: ${{ env.PESTER_RESULTS_DIR }}\coverage.xml
@@ -147,26 +147,26 @@ jobs:
     continue-on-error: true
     steps:
       - name: Download coverage results artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: CTK.Coverage.Summary
 
       - name: Setup .NET Core # Required to execute ReportGenerator
-        uses: actions/setup-dotnet@v3
+        uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3.4.2
         with:
           dotnet-version: 8.x
           dotnet-quality: "ga"
 
       - name: ReportGenerator
-        uses: danielpalme/ReportGenerator-GitHub-Action@5.2.4
+        uses: danielpalme/ReportGenerator-GitHub-Action@3e39bd1b454c2bac14560547e4394f9317672705 # 5.2.4
         with:
           reports: coverage.xml
           targetdir: coveragereport
           reporttypes: HtmlInline;MarkdownSummaryGithub;Badges
           historydir: coveragehistory
 
       - name: Upload coverage report artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coveragereport # Artifact name
           path: coveragereport # Directory containing files to upload

.github/workflows/markdown-lint.yml

@@ -26,9 +26,9 @@ jobs:
   markdown-check:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '18'
           check-latest: true

.github/workflows/sdl-compliance.yaml

@@ -24,16 +24,16 @@ jobs:
       security-events: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run DevSkim scanner
-        uses: microsoft/DevSkim-Action@v1
+        uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1.0.16
         with:
           # Relative path in $GITHUB_WORKSPACE for DevSkim to Scan
           directory-to-scan: containers-toolkit/
           ignore-globs: "en-US/**"
 
       - name: Upload DevSkim scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
         with:
           sarif_file: devskim-results.sarif