From 29b561e29c9f5ad82510b0f9d258cb41175669a6 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 12:52:18 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++++++ .github/workflows/ci-upgrade.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/pr.yml | 6 +++--- .github/workflows/template-buildsample.yml | 6 +++--- .github/workflows/template-buildwebsite.yml | 4 ++-- .github/workflows/template-upgradesample.yml | 6 +++--- .github/workflows/website-publish.yml | 2 +- 8 files changed, 23 insertions(+), 14 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9c8f5e84d..539533635 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -38,3 +38,12 @@ updates: commit-message: prefix: 📦 open-pull-requests-limit: 10 +- package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci-upgrade.yml b/.github/workflows/ci-upgrade.yml index 381d425b2..82facbf2b 100644 --- a/.github/workflows/ci-upgrade.yml +++ b/.github/workflows/ci-upgrade.yml @@ -14,7 +14,7 @@ jobs: name: Setup Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 call-upgradesample-calculator: name: Upgrade Calculator diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a22f8a1ae..5cc588156 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: name: Setup Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 call-buildsample-calculator: name: Build Calculator diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 5acca3c38..2cd5ff575 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -21,12 +21,12 @@ jobs: website: ${{ steps.filter.outputs.website }} workflows: ${{ steps.filter.outputs.workflows }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 # This task is to calculate which projects/paths had file changes # Project builds can be skipped in PR if no files changed # Changes to the "workflow" files should make projects build - - uses: dorny/paths-filter@v2 + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter with: filters: | @@ -91,4 +91,4 @@ jobs: runs-on: ubuntu-latest needs: [setupcheck, call-buildsample-calculator, call-buildsample-native-module-sample, call-buildwebsite] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 diff --git a/.github/workflows/template-buildsample.yml b/.github/workflows/template-buildsample.yml index 14ecc8dce..29b565602 100644 --- a/.github/workflows/template-buildsample.yml +++ b/.github/workflows/template-buildsample.yml @@ -44,7 +44,7 @@ jobs: name: "Check if build is required: ${{ !inputs.skipBuild }}" runs-on: 'ubuntu-latest' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 build-sample: name: Build ${{ inputs.sampleName }} ${{ inputs.configuration }} ${{ inputs.platform }} @@ -52,10 +52,10 @@ jobs: if: ${{ !inputs.skipBuild }} runs-on: ${{ inputs.vmImage }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22.14.0' diff --git a/.github/workflows/template-buildwebsite.yml b/.github/workflows/template-buildwebsite.yml index 6b604c7c6..b2edd43ab 100644 --- a/.github/workflows/template-buildwebsite.yml +++ b/.github/workflows/template-buildwebsite.yml @@ -21,7 +21,7 @@ jobs: name: "Check if build is required: ${{ !inputs.skipBuild }}" runs-on: 'ubuntu-latest' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 build_website: name: Build Website @@ -29,7 +29,7 @@ jobs: if: ${{ !inputs.skipBuild }} runs-on: ${{ inputs.vmImage }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Spell-check docs run: npx markdown-spellcheck "docs/*.md" "!docs/*-api-windows.md" --en-us --ignore-acronyms --ignore-numbers --report --color diff --git a/.github/workflows/template-upgradesample.yml b/.github/workflows/template-upgradesample.yml index 5168d42dc..e16e3b8d4 100644 --- a/.github/workflows/template-upgradesample.yml +++ b/.github/workflows/template-upgradesample.yml @@ -55,7 +55,7 @@ jobs: name: "Check if upgrade is required: ${{ !inputs.skipUpgrade }}" runs-on: 'ubuntu-latest' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 upgrade-sample: name: Upgrade ${{ inputs.sampleName }} ${{ inputs.configuration }} ${{ inputs.platform }} to ${{ inputs.reactNativeWindowsVersion }} @@ -63,10 +63,10 @@ jobs: if: ${{ !inputs.skipUpgrade }} runs-on: ${{ inputs.vmImage }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22.14.0' diff --git a/.github/workflows/website-publish.yml b/.github/workflows/website-publish.yml index b1ee2cc0c..65bac5429 100644 --- a/.github/workflows/website-publish.yml +++ b/.github/workflows/website-publish.yml @@ -21,7 +21,7 @@ jobs: git config --global user.name "React-Native-Windows Bot" echo "machine github.com login 53619745+rnbot password ${{ secrets.RNBOT_GH_TOKEN }}" > ~/.netrc - name: Git Checkout - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Yarn Install (Website) run: yarn install --frozen-lockfile working-directory: ./website