Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yaml

@@ -11,4 +11,6 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7

.github/workflows/defaultLabels.yml

@@ -13,7 +13,7 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:    
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         name: Setting issue as idle
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -24,7 +24,7 @@ jobs:
           operations-per-run: 100
           exempt-issue-labels: 'backlog'
 
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         name: Setting PR as idle
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/hourly-workflow-python310-flexcon.yaml

@@ -52,10 +52,10 @@ jobs:
         working-directory: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}
     steps:
       - name: 'Checkout repository'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Set up Python version: ${{ env.Python_VERSION }}'
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -65,7 +65,7 @@ jobs:
       # Perform additional steps such as running tests, if needed
 
       - name: 'Upload artifact for the deployment job'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.BUILD_ARTIFACT_NAME }}
           path: ${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}
@@ -77,20 +77,20 @@ jobs:
       id-token: write  # Required for OIDC
     steps:
       - name: 'Download artifact from build job'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ env.BUILD_ARTIFACT_NAME }}
           path: '${{ env.AZURE_FUNCTIONAPP_PROJECT_PATH }}/downloaded-artifact'
 
       - name: 'Log in to Azure with AZ CLI'
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_FLEXCON }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID_FA_E2E_TESTS }}
 
       - name: 'Run the Azure Functions action'
-        uses: Azure/functions-action@v1
+        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7
         id: deploy-to-function-app
         with:
           app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }}

.github/workflows/run-e2e-tests-dotnet8-lcon.yaml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -39,7 +39,7 @@ jobs:
       run: npm run build
 
     - name: E2E Setup DotNet ${{ env.DOTNET_VERSION }} Environment
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -51,7 +51,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_DOTNET8_LCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-dotnet8-wcon.yaml

@@ -25,10 +25,10 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -39,7 +39,7 @@ jobs:
       run: npm run build
 
     - name: E2E Setup DotNet ${{ env.DOTNET_VERSION }} Environment
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -51,7 +51,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_DOTNET8_WCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-java8-lcon.yaml

@@ -26,10 +26,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -40,7 +40,7 @@ jobs:
       run: npm run build
 
     - name: E2E Setup Java Sdk ${{ env.JAVA_VERSION }}
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1.4.5
       with:
         java-version: ${{ env.JAVA_VERSION }}
 
@@ -60,7 +60,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_JAVA8_LCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-java8-wcon.yaml

@@ -26,10 +26,10 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -40,7 +40,7 @@ jobs:
       run: npm run build
 
     - name: E2E Setup Java Sdk ${{ env.JAVA_VERSION }}
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1.4.5
       with:
         java-version: ${{ env.JAVA_VERSION }}
 
@@ -60,7 +60,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_JAVA8_WCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-node20-lcon.yaml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -39,7 +39,7 @@ jobs:
       run: npm run build
 
     - name: E2E Setup Node ${{ env.NODE_VERSION }} Environment
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -54,7 +54,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_NODE20_LCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-node20-wcon.yaml

@@ -25,10 +25,10 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -39,7 +39,7 @@ jobs:
       run: npm run build
 
     - name: E2E Setup Node ${{ env.NODE_VERSION }} Environment
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -54,7 +54,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_NODE20_WCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-powershell6-wcon.yaml

@@ -24,10 +24,10 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
@@ -45,7 +45,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_POWERSHELL6_WCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-python310-flexcon.yaml

@@ -25,15 +25,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
     - name: Setup Python ${{ env.PYTHON_VERSION }} Environment
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
@@ -53,7 +53,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_FLEXCON }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-e2e-tests-python310-lcon-msi.yaml

@@ -25,15 +25,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set Node.js 24.x for GitHub Action
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24.x
 
     - name: Setup Python ${{ env.PYTHON_VERSION }} Environment
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
@@ -53,7 +53,7 @@ jobs:
         popd
 
     - name: 'Login via Azure CLI'
-      uses: azure/login@v3
+      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID_FA_PYTHON310_LCON_MSI }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID_FA_E2E_TESTS }}

.github/workflows/run-unit-tests.yaml

@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: 'Checkout GitHub Action'
-      uses: actions/checkout@master
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node ${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ env.NODE_VERSION }}
 
@@ -44,6 +44,6 @@ jobs:
         npm run coverage-report
 
     - name: 'Upload Coverage Report to CodeCov'
-      uses: codecov/codecov-action@v7.0.0
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}