From 90a62b38d68ff9c7dd42052c3c8134d48f3165e9 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 15:49:04 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/agl.yml | 8 ++++---- .github/workflows/build.yml | 4 ++-- 3 files changed, 17 insertions(+), 6 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/agl.yml b/.github/workflows/agl.yml index bee4a0f1..a643a8a1 100644 --- a/.github/workflows/agl.yml +++ b/.github/workflows/agl.yml @@ -27,14 +27,14 @@ jobs: runs-on: windows-latest steps: - name: Checkout Code - uses: actions/checkout@v1 + uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0 - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@v1.1 + uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # v1.1.3 - name: Setup NuGet - uses: NuGet/setup-nuget@v1.0.2 + uses: NuGet/setup-nuget@255f46e14d51fbc603743e2aa2907954463fbeb9 # v1.0.2 env: ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true' @@ -48,7 +48,7 @@ jobs: run: 7z a agl.zip .\GraphLayout\tools\agl\bin\Release -r - name: Upload binaries to release - uses: svenstaro/upload-release-action@v2 + uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5 with: repo_token: ${{ secrets.GITHUB_TOKEN }} file: agl.zip diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index da85f152..29cd00b0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -16,7 +16,7 @@ jobs: uses: actions/checkout@master - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@v1.1 + uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # v1.1.3 - name: Restore NuGet Packages run: nuget restore GraphLayout/GraphLayout.sln @@ -28,7 +28,7 @@ jobs: run: msbuild GraphLayout\GraphLayout.sln /p:Configuration=Debug - name: Setup VSTest.exe - uses: Malcolmnixon/Setup-VSTest@v4 + uses: Malcolmnixon/Setup-VSTest@e29792f6ec069e574dc43f73a13c9ce66669a317 # v4 - name : Test run: vstest.console GraphLayout\Test\MSAGLTests\bin\Debug\net8.0-windows\Microsoft.Msagl.UnitTests.dll