Merge pull request #2 from danfiedler-msft/danfiedler/pin-actions

Pin GitHub Actions to full-length commit SHAs

Author: markjbrown

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/clone.yml

@@ -11,19 +11,19 @@ jobs:
       WORKING_BRANCH: auto
     steps:
       - name: Get GitHub App token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
         id: app-token
         with:
           app-id: ${{ secrets.PORTAL_QUICKSTART_SYNCHRONIZER_APP_ID }}
           private-key: ${{ secrets.PORTAL_QUICKSTART_SYNCHRONIZER_PRIVATE_KEY }}
       - name: Checkout source repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: azure-samples/cosmos-db-table-java-quickstart
           ref: main
           path: source
       - name: Checkout target repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           token: ${{ steps.app-token.outputs.token }}
           ref: ${{ github.head_ref }}

.github/workflows/release.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Get GitHub App token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
         id: app-token
         with:
           app-id: ${{ secrets.PORTAL_QUICKSTART_SYNCHRONIZER_APP_ID }}