Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yml

@@ -55,12 +55,12 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
           fetch-depth: 0 # Need for history to be able to determine version number
 
     - name: Setup .NET 8.x
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3.4.2
       with:
         # Semantic version range syntax or exact version of a dotnet version
         #dotnet-version: '8.x'
@@ -74,7 +74,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -100,6 +100,6 @@ jobs:
       run: dotnet build --no-restore dirs.proj --property:GenerateFullPaths=true --verbosity normal
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/package.yml

@@ -11,11 +11,11 @@ jobs:
       packages: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0 # Need for history to be able to determine version number
 
-      - uses: actions/setup-dotnet@v3
+      - uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3.4.2
         with:
           #dotnet-version: '8.0.x' # SDK Version to use.
           global-json-file: 'global.json'

.github/workflows/pr.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: [self-hosted, 1ES.Pool=powerbi-powershell-pool]
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0 # Need for history to be able to determine version number
 
@@ -27,13 +27,13 @@ jobs:
           scripts/DisableStrongName.ps1
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v3
+        uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3.4.2
         with:
           # Semantic version range syntax or exact version of a dotnet version
           #dotnet-version: '8.x'
           global-json-file: 'global.json'
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ~/.nuget/packages
           # Look to see if there is a cache hit for the corresponding requirements file
@@ -51,14 +51,14 @@ jobs:
         run: dotnet test --no-build --no-restore --collect "Code Coverage" -p:CollectCoverage=true -p:CoverletOutputFormat=cobertura --filter "TestCategory!=Interactive" --verbosity normal --logger trx --results-directory "TestResults" dirs.proj
 
       - name: Publish Test Results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: TestResults
           path: TestResults
         if: ${{ always() }}
 
       - name: Upload Code Coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: CodeCoverage
           path: src/**/coverage.cobertura.xml
@@ -72,38 +72,38 @@ jobs:
     if: ${{ always() && needs.Build.result == 'success' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 1 # Don't need full history for this job
 
       - name: Download Code Coverage
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: CodeCoverage
           path: TestResults
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v3
+        uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3.4.2
         with:
           dotnet-version: '8.x'
           dotnet-quality: 'ga'
 
       - name: ReportGenerator
-        uses: danielpalme/ReportGenerator-GitHub-Action@5.4.8
+        uses: danielpalme/ReportGenerator-GitHub-Action@4c0f60daf67483745c34efdeadd4c4e78a19991e # 5.4.8
         with:
           reports: TestResults/**/coverage.cobertura.xml
           targetdir: CodeCoverageReport
           sourcedirs: src
           reporttypes: HtmlInline;MarkdownSummaryGithub;Cobertura
 
       - name: Upload coverage report artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: CodeCoverageReport # Artifact name        
           path: CodeCoverageReport # Directory containing files to upload
 
       - name: Code Coverage Report
-        uses: irongut/CodeCoverageSummary@v1.3.0
+        uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
         with:
           filename: CodeCoverageReport/Cobertura.xml
           badge: true
@@ -116,7 +116,7 @@ jobs:
           thresholds: '25 80'
 
       - name: Add Coverage PR Comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
         with:
           recreate: true