From 950524d7fce8d4f256544a0f58dbb830a3585601 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Mon, 3 Aug 2026 16:02:42 -0700 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/bug-debugger.yml | 2 +- .github/workflows/by-design-closer-debugger .yml | 2 +- .github/workflows/by-design-closer.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/duplicate-closer.yml | 2 +- .github/workflows/enhancement-closer-no-milestone.yml | 2 +- .github/workflows/enhancement-closer-triage.yml | 2 +- .github/workflows/enhancement-reopener.yml | 2 +- .github/workflows/external-closer-debugger.yml | 2 +- .../workflows/feature-request-closer-no-milestone.yml | 2 +- .github/workflows/feature-request-closer-triage.yml | 2 +- .github/workflows/feature-request-debugger.yml | 2 +- .github/workflows/feature-request-reopener.yml | 2 +- .github/workflows/investigate-closer-debugger.yml | 2 +- .../workflows/investigate-costing-closer-debugger.yml | 2 +- .github/workflows/job-compile-and-test.yml | 10 +++++----- .github/workflows/locker.yml | 2 +- .../workflows/more-info-needed-closer-debugger.yml | 2 +- .github/workflows/more-info-needed-closer.yml | 2 +- .github/workflows/question-closer-debugger.yml | 2 +- .github/workflows/question-closer.yml | 2 +- 22 files changed, 38 insertions(+), 27 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/bug-debugger.yml b/.github/workflows/bug-debugger.yml index bcafecc0f..ea2629aaa 100644 --- a/.github/workflows/bug-debugger.yml +++ b/.github/workflows/bug-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Add Comment diff --git a/.github/workflows/by-design-closer-debugger .yml b/.github/workflows/by-design-closer-debugger .yml index f03586b37..7ba928489 100644 --- a/.github/workflows/by-design-closer-debugger .yml +++ b/.github/workflows/by-design-closer-debugger .yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/by-design-closer.yml b/.github/workflows/by-design-closer.yml index 0fe17b3d3..30b5fa0a9 100644 --- a/.github/workflows/by-design-closer.yml +++ b/.github/workflows/by-design-closer.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cb836d8b9..2ba0947c3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -59,11 +59,11 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -91,7 +91,7 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/duplicate-closer.yml b/.github/workflows/duplicate-closer.yml index 29c41d85d..b5cfca076 100644 --- a/.github/workflows/duplicate-closer.yml +++ b/.github/workflows/duplicate-closer.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/enhancement-closer-no-milestone.yml b/.github/workflows/enhancement-closer-no-milestone.yml index a24e19937..bd48cd252 100644 --- a/.github/workflows/enhancement-closer-no-milestone.yml +++ b/.github/workflows/enhancement-closer-no-milestone.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/enhancement-closer-triage.yml b/.github/workflows/enhancement-closer-triage.yml index 30d8230a9..ea4794708 100644 --- a/.github/workflows/enhancement-closer-triage.yml +++ b/.github/workflows/enhancement-closer-triage.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/enhancement-reopener.yml b/.github/workflows/enhancement-reopener.yml index b10666057..db583c6ee 100644 --- a/.github/workflows/enhancement-reopener.yml +++ b/.github/workflows/enhancement-reopener.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Run Reopener diff --git a/.github/workflows/external-closer-debugger.yml b/.github/workflows/external-closer-debugger.yml index dc5f35fa1..b83bf13df 100644 --- a/.github/workflows/external-closer-debugger.yml +++ b/.github/workflows/external-closer-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/feature-request-closer-no-milestone.yml b/.github/workflows/feature-request-closer-no-milestone.yml index 5312c0756..da987537a 100644 --- a/.github/workflows/feature-request-closer-no-milestone.yml +++ b/.github/workflows/feature-request-closer-no-milestone.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/feature-request-closer-triage.yml b/.github/workflows/feature-request-closer-triage.yml index 4ddab0ed6..ebfb85b23 100644 --- a/.github/workflows/feature-request-closer-triage.yml +++ b/.github/workflows/feature-request-closer-triage.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/feature-request-debugger.yml b/.github/workflows/feature-request-debugger.yml index 5202d0c53..869051dcb 100644 --- a/.github/workflows/feature-request-debugger.yml +++ b/.github/workflows/feature-request-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Add Comment diff --git a/.github/workflows/feature-request-reopener.yml b/.github/workflows/feature-request-reopener.yml index a060e2d13..cba126b67 100644 --- a/.github/workflows/feature-request-reopener.yml +++ b/.github/workflows/feature-request-reopener.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Run Reopener diff --git a/.github/workflows/investigate-closer-debugger.yml b/.github/workflows/investigate-closer-debugger.yml index d3b823ae9..e98caa1ca 100644 --- a/.github/workflows/investigate-closer-debugger.yml +++ b/.github/workflows/investigate-closer-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/investigate-costing-closer-debugger.yml b/.github/workflows/investigate-costing-closer-debugger.yml index 7b68f50f4..0b1c16a7d 100644 --- a/.github/workflows/investigate-costing-closer-debugger.yml +++ b/.github/workflows/investigate-costing-closer-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/job-compile-and-test.yml b/.github/workflows/job-compile-and-test.yml index cf96f22e0..e5911a5df 100644 --- a/.github/workflows/job-compile-and-test.yml +++ b/.github/workflows/job-compile-and-test.yml @@ -25,12 +25,12 @@ jobs: runs-on: ${{ inputs.runner-env }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: ref: ${{ inputs.checkout-ref }} - name: Use Node.js 24 - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 24 @@ -80,21 +80,21 @@ jobs: - name: Run languageServer integration tests (linux/macOS) if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }} - uses: coactions/setup-xvfb@v1 + uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1 with: run: yarn test --scenario=SingleRootProject working-directory: Extension - name: Run E2E IntelliSense features tests (linux/macOS) if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }} - uses: coactions/setup-xvfb@v1 + uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1 with: run: yarn test --scenario=MultirootDeadlockTest working-directory: Extension - name: Run RunWithoutDebugging tests (linux/macOS) if: ${{ inputs.platform == 'mac' || inputs.platform == 'linux' }} - uses: coactions/setup-xvfb@v1 + uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1 with: run: yarn test --scenario=RunWithoutDebugging --scenario-arg=skipExternalConsole working-directory: Extension diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml index 79d843630..d157e0077 100644 --- a/.github/workflows/locker.yml +++ b/.github/workflows/locker.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Run Locker diff --git a/.github/workflows/more-info-needed-closer-debugger.yml b/.github/workflows/more-info-needed-closer-debugger.yml index 87ae5cd38..a670a648e 100644 --- a/.github/workflows/more-info-needed-closer-debugger.yml +++ b/.github/workflows/more-info-needed-closer-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/more-info-needed-closer.yml b/.github/workflows/more-info-needed-closer.yml index 1d2016775..b11bcd588 100644 --- a/.github/workflows/more-info-needed-closer.yml +++ b/.github/workflows/more-info-needed-closer.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/question-closer-debugger.yml b/.github/workflows/question-closer-debugger.yml index 75616ceb3..16f566cc5 100644 --- a/.github/workflows/question-closer-debugger.yml +++ b/.github/workflows/question-closer-debugger.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer diff --git a/.github/workflows/question-closer.yml b/.github/workflows/question-closer.yml index ebcdb99be..d665a05b4 100644 --- a/.github/workflows/question-closer.yml +++ b/.github/workflows/question-closer.yml @@ -18,7 +18,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install Actions run: cd ./.github/actions && npm install --production && cd ../.. - name: Stale Closer