From ccf880b1fe64e5a5acae5df246999d29945e87b7 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Fri, 28 Aug 2026 21:17:14 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                   | 11 +++++++++++
 .github/workflows/build-publish-mcr.yaml |  6 +++---
 .github/workflows/e2e.yaml               |  6 +++---
 .github/workflows/k8scompat.yaml         | 10 +++++-----
 .github/workflows/smoke.yaml             |  4 ++--
 .github/workflows/unit.yaml              |  4 ++--
 6 files changed, 26 insertions(+), 15 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-publish-mcr.yaml b/.github/workflows/build-publish-mcr.yaml
index 6d91e73b..7d98787e 100644
--- a/.github/workflows/build-publish-mcr.yaml
+++ b/.github/workflows/build-publish-mcr.yaml
@@ -18,7 +18,7 @@ jobs:
     outputs:
       release_tag: ${{ github.event.release.tag_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
       - name: 'Set output variables'
@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: prepare-variables
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ needs.prepare-variables.outputs.release_tag }}
       - name: Build and push deployment manifest
@@ -58,7 +58,7 @@ jobs:
       labels: [self-hosted, "1ES.Pool=1es-aks-eno-pool-ubuntu"]
     needs: prepare-variables
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ needs.prepare-variables.outputs.release_tag }}
       - name: 'Login the ACR'
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 0c4860b1..b90f7c4f 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -24,14 +24,14 @@ jobs:
             disable_ssa: "true"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
 
       - name: Create Kind cluster
-        uses: helm/kind-action@v1
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
         with:
           node_image: kindest/node:v1.35.0
 
diff --git a/.github/workflows/k8scompat.yaml b/.github/workflows/k8scompat.yaml
index 71e1dcad..e9214183 100644
--- a/.github/workflows/k8scompat.yaml
+++ b/.github/workflows/k8scompat.yaml
@@ -15,10 +15,10 @@ jobs:
     outputs:
       matrix: ${{ steps.matrixbuild.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
 
       - name: Generate test matrix
         id: matrixbuild
@@ -29,7 +29,7 @@ jobs:
         run: go test -c -o eno-tests ./internal/controllers/reconciliation
 
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: test-artifacts
           retention-days: 1
@@ -44,10 +44,10 @@ jobs:
       matrix:
         downstreamApiserverMinorVersion: ${{ fromJson(needs.buildMatrix.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Download test artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: test-artifacts
 
diff --git a/.github/workflows/smoke.yaml b/.github/workflows/smoke.yaml
index 675c0948..f0e0a165 100644
--- a/.github/workflows/smoke.yaml
+++ b/.github/workflows/smoke.yaml
@@ -23,10 +23,10 @@ jobs:
             disable_ssa: "true"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Create Kind cluster
-        uses: helm/kind-action@v1
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
 
       - name: Wait for apiserver
         run: |
diff --git a/.github/workflows/unit.yaml b/.github/workflows/unit.yaml
index a007da17..9f213b7f 100644
--- a/.github/workflows/unit.yaml
+++ b/.github/workflows/unit.yaml
@@ -12,10 +12,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod