From 62ed893954d51b0f72c3130838d271470571c84d Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 18 Aug 2026 13:53:21 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml         | 11 +++++++++++
 .github/workflows/release.yaml |  4 ++--
 .github/workflows/stale.yaml   |  2 +-
 .github/workflows/test.yaml    |  4 ++--
 4 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..2c48305b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index dd60b12e3..0c994aad6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Checkout: https://github.com/actions/checkout
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ matrix.branch }}
           fetch-tags: true
@@ -45,7 +45,7 @@ jobs:
                 
       # Create a release: https://github.com/softprops/action-gh-release (MIT license)
       - name: Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         if: ${{ env.RELEASE != '' && env.RELEASE != 'no' }} 
         with:
           name: ${{ env.RELEASE }}
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index dff9cb656..ec5d51b2b 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -11,7 +11,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           days-before-issue-stale: 360
           days-before-issue-close: 14
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index d3662c607..0fd67daa5 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -29,7 +29,7 @@ jobs:
     steps:
       # Checkout: https://github.com/actions/checkout
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       # Basic
       - name: Debug
@@ -198,7 +198,7 @@ jobs:
       # MSYS2 mingw64 UCRT64
       - name: mingw-ucrt64 x64, Setup
         if: matrix.tests == 'mingw-ucrt64'
-        uses: msys2/setup-msys2@v2       
+        uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
         with: 
           msystem: UCRT64
           install: |