Pin GitHub Actions to full-length commit SHAs

[Dan Fiedler (danfiedler-msft)]

Summary

This PR pins GitHub Actions to full-length commit SHAs for improved security and reproducibility and adds a 7 day cooldown to Dependabot configuration for GitHub Actions. This work is described in more detail at https://aka.ms/action-pinning.

Why?

Pinning actions to commit SHAs prevents supply-chain attacks where a tag could be moved to point to malicious code. This is a recommended security best practice per the GitHub Actions security hardening guide.

This change mitigates the risk of tag retargeting to malicious code as seen in incidents like the tj-actions/changed-files action compromise or codfish/semantic-release-action compromise and improves the integrity and reproducibility of the CI/CD pipeline.

What changed?

Action pinning: Third-party action references in .github/workflows/ that used mutable tag-based references (e.g., actions/checkout@v4) have been updated to full-length commit SHAs with a version comment (e.g., actions/checkout@<sha> # v4) using the pinact tool. References that were already pinned to a SHA, or that used immutable release tags, were left unchanged.

Dependabot configuration: .github/dependabot.yml has been updated to ensure a github-actions package-ecosystem section is present with a cooldown configuration (default-days: 7). If the file did not exist, it was created. If a github-actions section already existed, only the cooldown block was added or its default-days value was increased to 7 if it was lower. The 7-day cooldown provides a window for the community to detect and report compromised releases before they are automatically proposed as updates, reducing exposure to supply-chain attacks via newly published malicious versions.

Is this safe to merge?

Yes. The pinned SHAs correspond to the same commits that the existing tags pointed to. No behavioral changes in action execution are introduced. You can verify the pinned SHA value using the GitHub REST API (e.g., the commit hash for actions/checkout@v7 can be found in the sha property in the JSON response for GET https://api.github.com/repos/actions/checkout/commits/v7).

Additional Information

For more information, please see https://aka.ms/action-pinning

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR improves CI/CD supply-chain security by replacing mutable GitHub Action version tags with full-length commit SHAs across the repository’s workflows (and a composite action), and introduces a Dependabot configuration for GitHub Actions with a 7-day cooldown to reduce exposure to newly published compromised releases.

Changes:

• Pin third-party GitHub Actions in .github/workflows/ to full commit SHAs (with version comments).
• Pin actions/checkout and actions/setup-python in the local composite action .github/actions/env-setup.
• Add .github/dependabot.yml for github-actions updates with weekly scheduling, grouping, and a 7-day cooldown.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/TriggerReferenceDocsCI.yml	Pins Azure/login to a full SHA (but workflow has an indentation issue in steps:).
.github/workflows/RunIssueSentinel.yml	Pins Azure/issue-sentinel to a full SHA.
.github/workflows/GitHookNotice.yml	Pins actions/checkout to a full SHA.
.github/workflows/CCOA.yml	Pins actions/github-script to a full SHA.
.github/workflows/BlockPRMerge.yml	Pins actions/github-script to a full SHA.
.github/workflows/AzdevStyle.yml	Pins actions/checkout to a full SHA.
.github/workflows/AzdevLinter.yml	Pins actions/checkout to a full SHA.
.github/workflows/AddIssueCommentWithLabel.yml	Pins actions/checkout and mshick/add-pr-comment to full SHAs.
.github/workflows/AddIssueComment.yml	Pins hasura/comment-progress to a full SHA.
.github/dependabot.yml	Adds Dependabot config for GitHub Actions with grouping, weekly interval, and 7-day cooldown.
.github/actions/env-setup/action.yml	Pins actions/checkout and actions/setup-python to full SHAs inside composite action.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

Pin GitHub Actions

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because no changed test file was found (tests/**/test_*.py).

The live-test pipeline runs only the test files a PR changes, so there is nothing to execute for this commit. A skipped live test is not a passing test result. The Agent review separately checks whether the affected command module includes focused regression tests or updated recordings. If a test file is changed in a later commit, the live test will run automatically.

[azure-client-tools-agent]

Dan Fiedler (@danfiedler-msft)

CI Review — PR #34008

Result: PASS

• Upstream CI: 1/1 required check passed, none pending.
• Test validation: Live test skipped — this PR changes only .github/ workflow/action files and .github/dependabot.yml; there are no runnable Python test selectors to exercise. Regression coverage is not applicable (no production files changed).
• Scope check: All 11 changed files consistently pin third-party/first-party GitHub Actions (actions/checkout, actions/setup-python, actions/github-script, hasura/comment-progress, mshick/add-pr-comment, Azure/issue-sentinel, Azure/login) to full-length immutable commit SHAs with the original version kept as a trailing comment, and add a dependabot.yml config to keep those pins current via grouped weekly PRs. No unrelated changes, no partial migrations, and no behavior change to any workflow's logic.
• Review-skill findings: None.

Risk assessment

3/100 · Low · Low confidence

The Low rating reflects the detected change scope with no elevated security, reliability, customer, operational, dependency, sovereign-cloud, generated-output, or cross-component signal.

• Change scope: 11 changed files, 35 changed lines (+23 / -12), including 0 production files.
• Affected components: No production component was identified.
• Risk drivers: No elevated risk signal was detected.
• Regression evidence: No production-code regression-test signal applies.
• Confidence: Low because no production changed-line evidence was available.
• Required review: No additional owning-squad review signal was detected.