From 5366cdb989763768a7f325fe01f722028da4317c Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 18 Aug 2026 14:34:51 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                  | 11 +++++++++++
 .github/workflows/cmind-lint.yml        |  4 ++--
 .github/workflows/cmind-pre-release.yml |  2 +-
 .github/workflows/cmind-release.yml     |  2 +-
 4 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/cmind-lint.yml b/.github/workflows/cmind-lint.yml
index e91cb63..ffd347a 100644
--- a/.github/workflows/cmind-lint.yml
+++ b/.github/workflows/cmind-lint.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@v19
+        uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19.1.0
         with:
           globs: |
             CoderMind/**/*.md
diff --git a/.github/workflows/cmind-pre-release.yml b/.github/workflows/cmind-pre-release.yml
index b1ccf42..607ed86 100644
--- a/.github/workflows/cmind-pre-release.yml
+++ b/.github/workflows/cmind-pre-release.yml
@@ -20,7 +20,7 @@ jobs:
       PROJECT_DIR: CoderMind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/cmind-release.yml b/.github/workflows/cmind-release.yml
index 246c455..1ae0514 100644
--- a/.github/workflows/cmind-release.yml
+++ b/.github/workflows/cmind-release.yml
@@ -19,7 +19,7 @@ jobs:
       PROJECT_DIR: CoderMind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}