Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -38,3 +38,12 @@ updates:
   commit-message:
     prefix: 📦
   open-pull-requests-limit: 10
+- package-ecosystem: "github-actions"
+  directory: "/"
+  groups:
+    github-actions:
+      patterns: ["*"]
+  schedule:
+    interval: "weekly"
+  cooldown:
+    default-days: 7

.github/workflows/ci-upgrade.yml

@@ -14,7 +14,7 @@ jobs:
     name: Setup Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
   call-upgradesample-calculator:
     name: Upgrade Calculator

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     name: Setup Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
   call-buildsample-calculator:
     name: Build Calculator

.github/workflows/pr.yml

@@ -21,12 +21,12 @@ jobs:
       website: ${{ steps.filter.outputs.website }}
       workflows: ${{ steps.filter.outputs.workflows }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     # This task is to calculate which projects/paths had file changes
     # Project builds can be skipped in PR if no files changed
     # Changes to the "workflow" files should make projects build
-    - uses: dorny/paths-filter@v2
+    - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
       id: filter
       with:
         filters: |
@@ -91,4 +91,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [setupcheck, call-buildsample-calculator, call-buildsample-native-module-sample, call-buildwebsite]
     steps:
-     - uses: actions/checkout@v3
+     - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0

.github/workflows/template-buildsample.yml

@@ -44,18 +44,18 @@ jobs:
     name: "Check if build is required: ${{ !inputs.skipBuild }}"
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
   build-sample:
     name: Build ${{ inputs.sampleName }} ${{ inputs.configuration }} ${{ inputs.platform }}
     needs: check
     if: ${{ !inputs.skipBuild }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '22.14.0'
 

.github/workflows/template-buildwebsite.yml

@@ -21,15 +21,15 @@ jobs:
     name: "Check if build is required: ${{ !inputs.skipBuild }}"
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
   build_website:
     name: Build Website
     needs: check
     if: ${{ !inputs.skipBuild }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Spell-check docs
       run: npx markdown-spellcheck "docs/*.md" "!docs/*-api-windows.md" --en-us --ignore-acronyms --ignore-numbers --report --color

.github/workflows/template-upgradesample.yml

@@ -55,18 +55,18 @@ jobs:
     name: "Check if upgrade is required: ${{ !inputs.skipUpgrade }}"
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
   upgrade-sample:
     name: Upgrade ${{ inputs.sampleName }} ${{ inputs.configuration }} ${{ inputs.platform }} to ${{ inputs.reactNativeWindowsVersion }}
     needs: check
     if: ${{ !inputs.skipUpgrade }}
     runs-on: ${{ inputs.vmImage }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '22.14.0'
 

.github/workflows/website-publish.yml

@@ -21,7 +21,7 @@ jobs:
         git config --global user.name "React-Native-Windows Bot"
         echo "machine github.com login 53619745+rnbot password ${{ secrets.RNBOT_GH_TOKEN }}" > ~/.netrc
     - name: Git Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
     - name: Yarn Install (Website)
       run: yarn install --frozen-lockfile
       working-directory: ./website