From af40dcfcebc948276b36500b03aedbeb0e97b882 Mon Sep 17 00:00:00 2001
From: Mahangu Weerasinghe <mahangu.weerasinghe@automattic.com>
Date: Mon, 8 Jun 2026 08:49:29 +0530
Subject: [PATCH] chore: pin third-party GitHub Actions to commit SHAs

Tracking: DEVPROD-1072
---
 .github/dependabot.yml                   | 22 ++++++++++++++++++++++
 .github/workflows/create-release.yml     |  2 +-
 .github/workflows/on-version-changed.yml |  2 +-
 .github/workflows/publish-release.yml    |  2 +-
 4 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..7ddd3840
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 273305b5..57619f80 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -36,7 +36,7 @@ jobs:
         run: ./bin/create-release-artifacts.sh ${{ inputs.version }}
 
       - name: Create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.version }}
diff --git a/.github/workflows/on-version-changed.yml b/.github/workflows/on-version-changed.yml
index df75dd5a..9c1a37e6 100644
--- a/.github/workflows/on-version-changed.yml
+++ b/.github/workflows/on-version-changed.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 2
 
-      - uses: salsify/action-detect-and-tag-new-version@v2
+      - uses: salsify/action-detect-and-tag-new-version@b1778166f13188a9d478e2d1198f993011ba9864 # v2.0.3
         id: check-version
         with:
           version-command: jq '.version' package.json
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 789784f1..a465eba6 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -43,7 +43,7 @@ jobs:
         run: sudo apt-get install subversion -y
 
       - name: Deploy to plugin directory
-        uses: 10up/action-wordpress-plugin-deploy@stable
+        uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0
         with:
           generate-zip: false
         env: