From a99d5f3e68d01ce54fc765f87fdb2efbcb30eb65 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 9 Sep 2026 15:38:26 +0000
Subject: [PATCH 1/3] Initial plan


From 67399451c7f4ab7d79b7db379aee83914661d560 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 9 Sep 2026 15:40:38 +0000
Subject: [PATCH 2/3] Allow cooldown in spelling checks

Co-authored-by: AmelBawa-msft <104940545+AmelBawa-msft@users.noreply.github.com>
---
 .github/actions/spelling/allow.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 6ed810a9..669c0fd4 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -24,6 +24,7 @@ cla
 codeowner
 codeowners
 coenraads
+cooldown
 dbaeumer
 devdocs
 eamodio

From ec747af3bcfb432350ef8cb4248fd28a7bc364de Mon Sep 17 00:00:00 2001
From: Dan Fiedler <151573964+danfiedler-msft@users.noreply.github.com>
Date: Wed, 9 Sep 2026 11:45:45 -0400
Subject: [PATCH 3/3] Pin GitHub Actions to full-length commit SHAs (#703)

---
 .github/dependabot.yml           | 11 +++++++++++
 .github/workflows/spellCheck.yml |  4 ++--
 2 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/spellCheck.yml b/.github/workflows/spellCheck.yml
index cd1af706..82374e62 100644
--- a/.github/workflows/spellCheck.yml
+++ b/.github/workflows/spellCheck.yml
@@ -91,7 +91,7 @@ jobs:
     steps:
       - name: check-spelling
         id: spelling
-        uses: check-spelling/check-spelling@v0.0.26
+        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
         with:
           suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
           checkout: true
@@ -140,7 +140,7 @@ jobs:
     if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@v0.0.26
+        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
         with:
           checkout: true
           task: ${{ needs.spelling.outputs.followup }}