Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -11,3 +11,5 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/build.yaml

@@ -37,7 +37,7 @@ jobs:
     - name: Look for prior successful runs
       id: check
       if: github.event.inputs.git_version == ''
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         result-encoding: string
@@ -199,7 +199,7 @@ jobs:
 
     - name: Checkout source
       if: steps.check.outputs.result == ''
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Validate Microsoft Git version
       if: steps.check.outputs.result == ''
@@ -249,7 +249,7 @@ jobs:
 
     - name: Upload microsoft/git installers
       if: steps.check.outputs.result == ''
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: MicrosoftGit
         path: MicrosoftGit
@@ -269,27 +269,27 @@ jobs:
     - name: Skip this job if there is a previous successful run
       if: needs.validate.outputs.skip != ''
       id: skip
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           core.info(`Skipping: There already is a successful run: ${{ needs.validate.outputs.skip }}`)
           return true
 
     - name: Checkout source
       if: steps.skip.outputs.result != 'true'
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         path: src
 
     - name: Install .NET SDK
       if: steps.skip.outputs.result != 'true'
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         global-json-file: src/global.json
 
     - name: Add MSBuild to PATH
       if: steps.skip.outputs.result != 'true'
-      uses: microsoft/setup-msbuild@v3.0.0
+      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
 
     - name: Build VFS for Git
       if: steps.skip.outputs.result != 'true'
@@ -308,21 +308,21 @@ jobs:
 
     - name: Upload functional tests drop
       if: steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: FunctionalTests_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: artifacts\GVFS.FunctionalTests
 
     - name: Upload FastFetch drop
       if: steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: FastFetch_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: artifacts\FastFetch
 
     - name: Upload GVFS installer
       if: steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: GVFS_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: artifacts\GVFS.Installers

.github/workflows/functional-tests.yaml

@@ -70,7 +70,7 @@ jobs:
     - name: Skip this job if there is a previous successful run
       if: inputs.skip != ''
       id: skip
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           core.info(`Skipping: There already is a successful run: ${{ inputs.skip }}`)
@@ -80,7 +80,7 @@ jobs:
       id: download-git
       if: steps.skip.outputs.result != 'true'
       continue-on-error: true
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: ${{ inputs.git_artifact_name }}
         path: git
@@ -90,7 +90,7 @@ jobs:
 
     - name: Download Git installer (retry)
       if: steps.skip.outputs.result != 'true' && steps.download-git.outcome == 'failure'
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: ${{ inputs.git_artifact_name }}
         path: git
@@ -102,7 +102,7 @@ jobs:
       id: download-gvfs
       if: steps.skip.outputs.result != 'true'
       continue-on-error: true
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: GVFS_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: gvfs
@@ -112,7 +112,7 @@ jobs:
 
     - name: Download GVFS installer (retry)
       if: steps.skip.outputs.result != 'true' && steps.download-gvfs.outcome == 'failure'
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: GVFS_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: gvfs
@@ -124,7 +124,7 @@ jobs:
       id: download-ft
       if: steps.skip.outputs.result != 'true'
       continue-on-error: true
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: FunctionalTests_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: ft
@@ -134,7 +134,7 @@ jobs:
 
     - name: Download functional tests drop (retry)
       if: steps.skip.outputs.result != 'true' && steps.download-ft.outcome == 'failure'
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: FunctionalTests_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: ft
@@ -145,7 +145,7 @@ jobs:
     - name: Download FastFetch drop
       if: steps.skip.outputs.result != 'true'
       continue-on-error: true
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: FastFetch_${{ matrix.configuration }}_${{ matrix.architecture }}
         path: ft
@@ -189,7 +189,7 @@ jobs:
 
     - name: Upload installation logs
       if: always() && steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       continue-on-error: true
       with:
         name: ${{ env.ARTIFACT_PREFIX }}InstallationLogs_${{ env.FT_MATRIX_NAME }}
@@ -208,14 +208,14 @@ jobs:
 
     - name: Upload functional test results
       if: always() && steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ env.ARTIFACT_PREFIX }}FunctionalTests_Results_${{ env.FT_MATRIX_NAME }}
         path: TestResult.xml
 
     - name: Upload Git trace2 output
       if: always() && steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ env.ARTIFACT_PREFIX }}GitTrace2_${{ env.FT_MATRIX_NAME }}
         path: C:\temp\git-trace2.log

.github/workflows/upgrade-tests.yaml

@@ -40,7 +40,7 @@ jobs:
     - name: Skip this job if there is a previous successful run
       if: inputs.skip != ''
       id: skip
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           core.info(`Skipping: There already is a successful run: ${{ inputs.skip }}`)
@@ -66,14 +66,14 @@ jobs:
       id: download-git
       if: steps.skip.outputs.result != 'true'
       continue-on-error: true
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: MicrosoftGit
         path: git
 
     - name: Download Git installer (retry)
       if: steps.skip.outputs.result != 'true' && steps.download-git.outcome == 'failure'
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: MicrosoftGit
         path: git
@@ -82,14 +82,14 @@ jobs:
       id: download-gvfs
       if: steps.skip.outputs.result != 'true'
       continue-on-error: true
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: GVFS_${{ matrix.configuration }}_x64
         path: gvfs-new
 
     - name: Download current GVFS installer (retry)
       if: steps.skip.outputs.result != 'true' && steps.download-gvfs.outcome == 'failure'
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: GVFS_${{ matrix.configuration }}_x64
         path: gvfs-new
@@ -370,7 +370,7 @@ jobs:
 
     - name: Upload service logs
       if: always() && steps.skip.outputs.result != 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       continue-on-error: true
       with:
         name: UpgradeTest_Logs_${{ matrix.scenario }}