From e840f42480337c546e01f03f79e454491c64dad4 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 18 Aug 2026 14:04:42 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                             | 14 ++++++++------
 .../format-crash-report-in-issue-body.yml          |  2 +-
 .../minecraft-crash-reported-upstream-check.yml    |  2 +-
 .github/workflows/minecraft-crash.yml              |  2 +-
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index adec0c0..177b067 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,8 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/format-crash-report-in-issue-body.yml b/.github/workflows/format-crash-report-in-issue-body.yml
index 098d4b3..fd68adc 100644
--- a/.github/workflows/format-crash-report-in-issue-body.yml
+++ b/.github/workflows/format-crash-report-in-issue-body.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Format crash report
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const issueNumber = context.issue.number
diff --git a/.github/workflows/minecraft-crash-reported-upstream-check.yml b/.github/workflows/minecraft-crash-reported-upstream-check.yml
index 295cb09..11140cf 100644
--- a/.github/workflows/minecraft-crash-reported-upstream-check.yml
+++ b/.github/workflows/minecraft-crash-reported-upstream-check.yml
@@ -14,7 +14,7 @@ jobs:
         # Ignore pull request comments, see
         # https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#issue_comment
         if: ${{ !github.event.issue.pull_request }}
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // See documentation for payload properties
diff --git a/.github/workflows/minecraft-crash.yml b/.github/workflows/minecraft-crash.yml
index e68299b..695a512 100644
--- a/.github/workflows/minecraft-crash.yml
+++ b/.github/workflows/minecraft-crash.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check Minecraft crash
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // Strings which indicate that Minecraft is modded