Pin GitHub Actions to full-length commit SHAs (#320)

Author: danfiedler-msft

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/main-build.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: create ArtifactStagingDirectory folder
       run: mkdir drop
@@ -41,7 +41,7 @@ jobs:
     # Building and testing .NET
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: 8.0.x
 
@@ -94,7 +94,7 @@ jobs:
       run: cp durablefunctionsmonitor.dotnetisolated/LICENSE.txt drop/durablefunctionsmonitor.dotnetisolated/output
 
     - name: Install latest nuget.exe
-      uses: nuget/setup-nuget@v1.2.0
+      uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f # v1.2.0
     - name: package dotnetbackend into a Nuget package
       run: nuget pack drop/durablefunctionsmonitor.dotnetbackend/output/nuspec.nuspec -OutputDirectory drop
     - name: package dotnetisolated into a Nuget package
@@ -103,7 +103,7 @@ jobs:
     # Publish artifacts
 
     - name: publish artifacts
-      uses: actions/upload-artifact@v4.1.0
+      uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
       with:
         path: drop
 

.github/workflows/push-to-docker-hub.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # Building and copying React
 
@@ -38,7 +38,7 @@ jobs:
     # Building and testing .NET
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: 8.0.x
 
@@ -48,27 +48,27 @@ jobs:
       run: dotnet test tests/durablefunctionsmonitor.dotnetisolated.core.tests/*.csproj
 
     - name: login to Docker hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
 
     - name: build and push durablefunctionsmonitor.dotnetbackend
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
       with:
         context: ./durablefunctionsmonitor.dotnetbackend
         push: true
         tags: scaletone/durablefunctionsmonitor:${{ github.event.inputs.imageTag }}
 
     - name: build and push custom-backends/mssql
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
       with:
         context: ./custom-backends/mssql
         push: true
         tags: scaletone/durablefunctionsmonitor.mssql:${{ github.event.inputs.imageTag }}
 
     - name: build and push custom-backends/netherite
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
       with:
         context: ./custom-backends/netherite
         push: true

.github/workflows/push-to-nuget.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: create ArtifactStagingDirectory folder
       run: mkdir drop
@@ -37,7 +37,7 @@ jobs:
     # Building and testing .NET
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: 8.0.x
 
@@ -69,7 +69,7 @@ jobs:
       run: cp durablefunctionsmonitor.dotnetisolated/LICENSE.txt drop/dotnetIsolated-mssql/output
 
     - name: Install latest nuget.exe
-      uses: nuget/setup-nuget@v1.2.0
+      uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f # v1.2.0
     - name: package dotnetbackend into a Nuget package
       run: nuget pack drop/durablefunctionsmonitor.dotnetbackend/output/nuspec.nuspec -OutputDirectory drop
     - name: package dotnetisolated into a Nuget package

.github/workflows/push-to-vscode-marketplace.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: create ArtifactStagingDirectory folder
       run: mkdir drop
@@ -37,7 +37,7 @@ jobs:
     # Building and testing .NET
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: 8.0.x