{CI} Pin GitHub Actions to full-length commit SHAs (#34008)

Author: danfiedler-msft

.github/actions/env-setup/action.yml

@@ -12,13 +12,13 @@ runs:
       run: |
         echo start azdev env setup
     - name: Checkout CLI repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0 # checkout all branches
         ref: ${{ github.event.pull_request.head.ref }}
         repository: ${{ github.event.pull_request.head.repo.full_name }}  # checkout pull request branch
     - name: Set up Python 3.12
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
       with:
         python-version: "3.12"
     - name: Install azdev

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/AddIssueComment.yml

@@ -10,7 +10,7 @@ jobs:
     name: Say thanks for the Issue
     steps:
       - name: comment on the issue
-        uses: hasura/comment-progress@v2.3.0
+        uses: hasura/comment-progress@146c635f3e325d478025e29e5043ec1c07c0e36c # v2.3.0
         with:
           github-token: ${{ secrets.CLI_BOT }}
           repository: 'Azure/azure-cli'

.github/workflows/AddIssueCommentWithLabel.yml

@@ -12,12 +12,12 @@ jobs:
     name: Comment on issue
     steps:
       - name: Checkout comment message
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           sparse-checkout: |
             .github/template/non-security-comment.md
       - name: Comment on issue with no security label
-        uses: mshick/add-pr-comment@v2
+        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         with:
            repo-token: ${{ secrets.GITHUB_TOKEN }}
            message-id: issueNoSecurityCommentBot

.github/workflows/AzdevLinter.yml

@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout CLI repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 1
           sparse-checkout: |

.github/workflows/AzdevStyle.yml

@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout CLI repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 1
           sparse-checkout: |

.github/workflows/BlockPRMerge.yml

@@ -15,7 +15,7 @@ jobs:
     permissions: {}
     steps:
       - name: Check blocked labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const labels = context.payload.pull_request.labels.map(label => label.name);

.github/workflows/CCOA.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Comment on PR
         if: steps.date_check.outputs.continue == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/GitHookNotice.yml

@@ -15,7 +15,7 @@ jobs:
     name: Introduce git hook in developer env
     steps:
       - name: Checkout git hook notice message
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           sparse-checkout: |
             .github/template/git-hooks-note.md

.github/workflows/RunIssueSentinel.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run Issue Sentinel
-        uses: Azure/issue-sentinel@v1
+        uses: Azure/issue-sentinel@d1e433f192aa9442d44292b9b6d5d31419639aba # v1.6.1
         with:
           enable-similar-issues-scanning: true
           enable-security-issues-scanning: true