From 5a2ae2d2aca7fd909081c6e0c592599ca4ac834d Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 28 Aug 2026 21:24:56 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yaml | 4 +++- .github/workflows/defaultLabels.yml | 4 ++-- .../workflows/hourly-workflow-python310-flexcon.yaml | 12 ++++++------ .github/workflows/run-e2e-tests-dotnet8-lcon.yaml | 8 ++++---- .github/workflows/run-e2e-tests-dotnet8-wcon.yaml | 8 ++++---- .github/workflows/run-e2e-tests-java8-lcon.yaml | 8 ++++---- .github/workflows/run-e2e-tests-java8-wcon.yaml | 8 ++++---- .github/workflows/run-e2e-tests-node20-lcon.yaml | 8 ++++---- .github/workflows/run-e2e-tests-node20-wcon.yaml | 8 ++++---- .../workflows/run-e2e-tests-powershell6-wcon.yaml | 6 +++--- .../workflows/run-e2e-tests-python310-flexcon.yaml | 8 ++++---- .../workflows/run-e2e-tests-python310-lcon-msi.yaml | 8 ++++---- .github/workflows/run-unit-tests.yaml | 4 ++-- .github/workflows/test-workflow-dotnet8-lcon.yaml | 12 ++++++------ .github/workflows/test-workflow-dotnet8-wcon.yaml | 12 ++++++------ .github/workflows/test-workflow-java8-lcon.yaml | 12 ++++++------ .github/workflows/test-workflow-java8-wcon.yaml | 12 ++++++------ .github/workflows/test-workflow-node20-lcon.yaml | 12 ++++++------ .github/workflows/test-workflow-node20-wcon.yaml | 12 ++++++------ .../workflows/test-workflow-powershell6-wcon.yaml | 6 +++--- .../workflows/test-workflow-python310-flexcon.yaml | 12 ++++++------ .github/workflows/test-workflow-python310-lcon.yaml | 12 ++++++------ 22 files changed, 99 insertions(+), 97 deletions(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 7ad87f75a..d845341c4 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -11,4 +11,6 @@ updates: directory: "/" schedule: interval: "weekly" - open-pull-requests-limit: 5 \ No newline at end of file + open-pull-requests-limit: 5 + cooldown: + default-days: 7 \ No newline at end of file diff --git a/.github/workflows/defaultLabels.yml b/.github/workflows/defaultLabels.yml index b210263d1..c62c99540 100644 --- a/.github/workflows/defaultLabels.yml +++ b/.github/workflows/defaultLabels.yml @@ -13,7 +13,7 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 name: Setting issue as idle with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -24,7 +24,7 @@ jobs: operations-per-run: 100 exempt-issue-labels: 'backlog' - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 name: Setting PR as idle with: repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/hourly-workflow-python310-flexcon.yaml b/.github/workflows/hourly-workflow-python310-flexcon.yaml index a3ab81f70..341a218c7 100644 --- a/.github/workflows/hourly-workflow-python310-flexcon.yaml +++ b/.github/workflows/hourly-workflow-python310-flexcon.yaml @@ -52,10 +52,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Python version: ${{ env.Python_VERSION }}' - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -65,7 +65,7 @@ jobs: # Perform additional steps such as running tests, if needed - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} @@ -77,20 +77,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_FLEXCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/run-e2e-tests-dotnet8-lcon.yaml b/.github/workflows/run-e2e-tests-dotnet8-lcon.yaml index 44d519326..efd49085e 100644 --- a/.github/workflows/run-e2e-tests-dotnet8-lcon.yaml +++ b/.github/workflows/run-e2e-tests-dotnet8-lcon.yaml @@ -25,10 +25,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -39,7 +39,7 @@ jobs: run: npm run build - name: E2E Setup DotNet ${{ env.DOTNET_VERSION }} Environment - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ env.DOTNET_VERSION }} @@ -51,7 +51,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_DOTNET8_LCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-dotnet8-wcon.yaml b/.github/workflows/run-e2e-tests-dotnet8-wcon.yaml index 006d8de0e..a77b4322a 100644 --- a/.github/workflows/run-e2e-tests-dotnet8-wcon.yaml +++ b/.github/workflows/run-e2e-tests-dotnet8-wcon.yaml @@ -25,10 +25,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -39,7 +39,7 @@ jobs: run: npm run build - name: E2E Setup DotNet ${{ env.DOTNET_VERSION }} Environment - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ env.DOTNET_VERSION }} @@ -51,7 +51,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_DOTNET8_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-java8-lcon.yaml b/.github/workflows/run-e2e-tests-java8-lcon.yaml index 838025510..965adbd8f 100644 --- a/.github/workflows/run-e2e-tests-java8-lcon.yaml +++ b/.github/workflows/run-e2e-tests-java8-lcon.yaml @@ -26,10 +26,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -40,7 +40,7 @@ jobs: run: npm run build - name: E2E Setup Java Sdk ${{ env.JAVA_VERSION }} - uses: actions/setup-java@v1 + uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1.4.5 with: java-version: ${{ env.JAVA_VERSION }} @@ -60,7 +60,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_JAVA8_LCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-java8-wcon.yaml b/.github/workflows/run-e2e-tests-java8-wcon.yaml index d96562734..f69a21c2b 100644 --- a/.github/workflows/run-e2e-tests-java8-wcon.yaml +++ b/.github/workflows/run-e2e-tests-java8-wcon.yaml @@ -26,10 +26,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -40,7 +40,7 @@ jobs: run: npm run build - name: E2E Setup Java Sdk ${{ env.JAVA_VERSION }} - uses: actions/setup-java@v1 + uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1.4.5 with: java-version: ${{ env.JAVA_VERSION }} @@ -60,7 +60,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_JAVA8_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-node20-lcon.yaml b/.github/workflows/run-e2e-tests-node20-lcon.yaml index 8950e2614..3686be837 100644 --- a/.github/workflows/run-e2e-tests-node20-lcon.yaml +++ b/.github/workflows/run-e2e-tests-node20-lcon.yaml @@ -25,10 +25,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -39,7 +39,7 @@ jobs: run: npm run build - name: E2E Setup Node ${{ env.NODE_VERSION }} Environment - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -54,7 +54,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_NODE20_LCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-node20-wcon.yaml b/.github/workflows/run-e2e-tests-node20-wcon.yaml index 49b827d1c..f18186a3e 100644 --- a/.github/workflows/run-e2e-tests-node20-wcon.yaml +++ b/.github/workflows/run-e2e-tests-node20-wcon.yaml @@ -25,10 +25,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -39,7 +39,7 @@ jobs: run: npm run build - name: E2E Setup Node ${{ env.NODE_VERSION }} Environment - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -54,7 +54,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_NODE20_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-powershell6-wcon.yaml b/.github/workflows/run-e2e-tests-powershell6-wcon.yaml index 73772a157..edd6cee56 100644 --- a/.github/workflows/run-e2e-tests-powershell6-wcon.yaml +++ b/.github/workflows/run-e2e-tests-powershell6-wcon.yaml @@ -24,10 +24,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x @@ -45,7 +45,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_POWERSHELL6_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-python310-flexcon.yaml b/.github/workflows/run-e2e-tests-python310-flexcon.yaml index eadc1a268..b6f43f85f 100644 --- a/.github/workflows/run-e2e-tests-python310-flexcon.yaml +++ b/.github/workflows/run-e2e-tests-python310-flexcon.yaml @@ -25,15 +25,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x - name: Setup Python ${{ env.PYTHON_VERSION }} Environment - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -53,7 +53,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_FLEXCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-e2e-tests-python310-lcon-msi.yaml b/.github/workflows/run-e2e-tests-python310-lcon-msi.yaml index 139c4e8a1..25e313b5a 100644 --- a/.github/workflows/run-e2e-tests-python310-lcon-msi.yaml +++ b/.github/workflows/run-e2e-tests-python310-lcon-msi.yaml @@ -25,15 +25,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Node.js 24.x for GitHub Action - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x - name: Setup Python ${{ env.PYTHON_VERSION }} Environment - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -53,7 +53,7 @@ jobs: popd - name: 'Login via Azure CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_LCON_MSI }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} diff --git a/.github/workflows/run-unit-tests.yaml b/.github/workflows/run-unit-tests.yaml index 740686d42..eb7eee392 100644 --- a/.github/workflows/run-unit-tests.yaml +++ b/.github/workflows/run-unit-tests.yaml @@ -21,7 +21,7 @@ jobs: uses: actions/checkout@master - name: Setup Node ${{ env.NODE_VERSION }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -44,6 +44,6 @@ jobs: npm run coverage-report - name: 'Upload Coverage Report to CodeCov' - uses: codecov/codecov-action@v7.0.0 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/test-workflow-dotnet8-lcon.yaml b/.github/workflows/test-workflow-dotnet8-lcon.yaml index 45a96bbab..f6264ece7 100644 --- a/.github/workflows/test-workflow-dotnet8-lcon.yaml +++ b/.github/workflows/test-workflow-dotnet8-lcon.yaml @@ -56,10 +56,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up .NET version: ${{ env.DOTNET_VERSION }}' - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ env.DOTNET_VERSION }} @@ -69,7 +69,7 @@ jobs: run: dotnet publish --configuration Release --output ./output - name: Upload artifact for the deployment job - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/output @@ -82,20 +82,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_DOTNET8_LCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-dotnet8-wcon.yaml b/.github/workflows/test-workflow-dotnet8-wcon.yaml index 79b75f1c0..715000c54 100644 --- a/.github/workflows/test-workflow-dotnet8-wcon.yaml +++ b/.github/workflows/test-workflow-dotnet8-wcon.yaml @@ -56,10 +56,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up .NET version: ${{ env.DOTNET_VERSION }}' - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ env.DOTNET_VERSION }} @@ -69,7 +69,7 @@ jobs: run: dotnet publish --configuration Release --output ./output - name: Upload artifact for the deployment job - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/output @@ -82,20 +82,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_DOTNET8_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-java8-lcon.yaml b/.github/workflows/test-workflow-java8-lcon.yaml index 8e5778c9d..c76883dfb 100644 --- a/.github/workflows/test-workflow-java8-lcon.yaml +++ b/.github/workflows/test-workflow-java8-lcon.yaml @@ -54,10 +54,10 @@ jobs: working-directory: ${{ env.POM_XML_DIRECTORY }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Java version: ${{ env.JAVA_VERSION }}' - uses: actions/setup-java@v1 + uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1.4.5 with: java-version: ${{ env.JAVA_VERSION }} distribution: 'microsoft' @@ -75,7 +75,7 @@ jobs: # Perform additional steps such as running tests, if needed - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.POM_XML_DIRECTORY }}/target/azure-functions/${{ env.AZURE_FUNCTIONAPP_NAME }} @@ -87,20 +87,20 @@ jobs: id-token: write # Required to fetch an OIDC token to authenticate with the job steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.POM_XML_DIRECTORY }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_JAVA8_LCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-java8-wcon.yaml b/.github/workflows/test-workflow-java8-wcon.yaml index c86eb601e..3cdae740d 100644 --- a/.github/workflows/test-workflow-java8-wcon.yaml +++ b/.github/workflows/test-workflow-java8-wcon.yaml @@ -54,10 +54,10 @@ jobs: working-directory: ${{ env.POM_XML_DIRECTORY }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Java version: ${{ env.JAVA_VERSION }}' - uses: actions/setup-java@v1 + uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1.4.5 with: java-version: ${{ env.JAVA_VERSION }} distribution: 'microsoft' @@ -75,7 +75,7 @@ jobs: # Perform additional steps such as running tests, if needed - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.POM_XML_DIRECTORY }}/target/azure-functions/${{ env.AZURE_FUNCTIONAPP_NAME }} @@ -87,20 +87,20 @@ jobs: id-token: write # Required to fetch an OIDC token to authenticate with the job steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.POM_XML_DIRECTORY }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_JAVA8_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-node20-lcon.yaml b/.github/workflows/test-workflow-node20-lcon.yaml index e00ca3432..940f7bb79 100644 --- a/.github/workflows/test-workflow-node20-lcon.yaml +++ b/.github/workflows/test-workflow-node20-lcon.yaml @@ -54,10 +54,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Node version: ${{ env.NODE_VERSION }}' - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -74,7 +74,7 @@ jobs: run: npm prune --production - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} @@ -86,20 +86,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_NODE20_LCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-node20-wcon.yaml b/.github/workflows/test-workflow-node20-wcon.yaml index 181282d68..7253ea4c7 100644 --- a/.github/workflows/test-workflow-node20-wcon.yaml +++ b/.github/workflows/test-workflow-node20-wcon.yaml @@ -54,10 +54,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Node version: ${{ env.NODE_VERSION }}' - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -74,7 +74,7 @@ jobs: run: npm prune --production - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} @@ -86,20 +86,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_NODE20_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-powershell6-wcon.yaml b/.github/workflows/test-workflow-powershell6-wcon.yaml index fa60b494a..b08b2aafa 100644 --- a/.github/workflows/test-workflow-powershell6-wcon.yaml +++ b/.github/workflows/test-workflow-powershell6-wcon.yaml @@ -49,19 +49,19 @@ jobs: contents: read # Required for actions/checkout steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Perform additional steps such as running tests, if needed - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_POWERSHELL6_WCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-python310-flexcon.yaml b/.github/workflows/test-workflow-python310-flexcon.yaml index c2dd842bc..b3f511dd6 100644 --- a/.github/workflows/test-workflow-python310-flexcon.yaml +++ b/.github/workflows/test-workflow-python310-flexcon.yaml @@ -54,10 +54,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Python version: ${{ env.Python_VERSION }}' - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -67,7 +67,7 @@ jobs: # Perform additional steps such as running tests, if needed - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} @@ -79,20 +79,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_FLEXCON }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} diff --git a/.github/workflows/test-workflow-python310-lcon.yaml b/.github/workflows/test-workflow-python310-lcon.yaml index 45593be36..7d482bbd1 100644 --- a/.github/workflows/test-workflow-python310-lcon.yaml +++ b/.github/workflows/test-workflow-python310-lcon.yaml @@ -54,10 +54,10 @@ jobs: working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} steps: - name: 'Checkout repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Set up Python version: ${{ env.Python_VERSION }}' - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -67,7 +67,7 @@ jobs: # Perform additional steps such as running tests, if needed - name: 'Upload artifact for the deployment job' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }} @@ -79,20 +79,20 @@ jobs: id-token: write # Required for OIDC steps: - name: 'Download artifact from build job' - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ env.BUILD_ARTIFACT_NAME }} path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact' - name: 'Log in to Azure with AZ CLI' - uses: azure/login@v3 + uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2 with: client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_LCON_MSI }} tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }} - name: 'Run the Azure Functions action' - uses: Azure/functions-action@v1 + uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7 id: deploy-to-function-app with: app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} From bfc38493ec3429b3c7a4c794d1c867e5411c60d8 Mon Sep 17 00:00:00 2001 From: Finbar Ryan Date: Mon, 14 Sep 2026 20:06:38 -0500 Subject: [PATCH 2/2] Pin checkout action in unit tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/run-unit-tests.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/run-unit-tests.yaml b/.github/workflows/run-unit-tests.yaml index eb7eee392..861ef58e2 100644 --- a/.github/workflows/run-unit-tests.yaml +++ b/.github/workflows/run-unit-tests.yaml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout GitHub Action' - uses: actions/checkout@master + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node ${{ env.NODE_VERSION }} uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0