From bfc1462567e6bcc2f453280b88b44616afe8c619 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Fri, 28 Aug 2026 19:14:09 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                          |  2 ++
 .github/workflows/codeql.yml                    |  4 ++--
 .github/workflows/deployAzGovViz.yml            | 10 +++++-----
 .github/workflows/deployAzGovVizAccelerator.yml |  4 ++--
 .github/workflows/syncAccelerator.yml           |  2 +-
 .github/workflows/syncAzGovViz.yml              |  2 +-
 6 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b39a2ba..5fd8299 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4ae2aa9..005f9b4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,11 +27,11 @@ jobs:
         uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           languages: ${{ matrix.language }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/deployAzGovViz.yml b/.github/workflows/deployAzGovViz.yml
index 2888b34..10067bb 100644
--- a/.github/workflows/deployAzGovViz.yml
+++ b/.github/workflows/deployAzGovViz.yml
@@ -40,7 +40,7 @@ jobs:
         uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
 
       - name: Connect Azure OIDC
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 #v2.3.0
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{secrets.CLIENT_ID}} #create this secret
           tenant-id: ${{secrets.TENANT_ID}} #create this secret
@@ -48,14 +48,14 @@ jobs:
           enable-AzPSSession: true
 
       - name: Check prerequisites
-        uses: azure/powershell@v1
+        uses: azure/powershell@1300bbd2b3e1c21c029fe34887d16d2809a1397f # v1.4.0
         with:
           inlineScript: |
             . .\$($env:ScriptDir)\$($env:ScriptPrereqFile) -OutputPath ${env:OutputPath}
           azPSVersion: "latest"
 
       - name: Run Azure Governance Visualizer
-        uses: azure/powershell@v1
+        uses: azure/powershell@1300bbd2b3e1c21c029fe34887d16d2809a1397f # v1.4.0
         with:
           inlineScript: |
             . .\$($env:ScriptDir)\$($env:ScriptFile) -ManagementGroupId ${env:ManagementGroupId} -SubscriptionId4AzContext ${{secrets.SUBSCRIPTION_ID}} -ScriptPath ${env:ScriptDir} -OutputPath ${env:OutputPath} -GitHubActionsOIDC
@@ -73,7 +73,7 @@ jobs:
       #log again to avoid timeout before web publishing
       - name: Connect Azure OIDC
         if: env.WebAppPublish == 'true'
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 #v2.3.0
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{secrets.CLIENT_ID}} #create this secret (GitHub/Setting/Secrets)
           tenant-id: ${{secrets.TENANT_ID}} #create this secret
@@ -82,7 +82,7 @@ jobs:
 
       - name: Publish HTML to WebApp
         if: env.WebAppPublish == 'true'
-        uses: azure/powershell@v1
+        uses: azure/powershell@1300bbd2b3e1c21c029fe34887d16d2809a1397f # v1.4.0
         with:
           inlineScript: |
             $azAPICallConf = initAzAPICall -DebugAzAPICall $true
diff --git a/.github/workflows/deployAzGovVizAccelerator.yml b/.github/workflows/deployAzGovVizAccelerator.yml
index 43c1f59..6ebfd11 100644
--- a/.github/workflows/deployAzGovVizAccelerator.yml
+++ b/.github/workflows/deployAzGovVizAccelerator.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
       - name: Login to Azure
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 #v2.3.0
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -32,7 +32,7 @@ jobs:
       - name: Deploy web app to Azure
         id: deployWebApp
         if: ${{github.event.inputs.PublishTo}} == 'Azure Web App'
-        uses: azure/arm-deploy@v1
+        uses: azure/arm-deploy@65ae74fb7aec7c680c88ef456811f353adae4d06 # v1.0.9
         with:
           scope: resourcegroup
           subscriptionId: ${{ secrets.SUBSCRIPTION_ID }}
diff --git a/.github/workflows/syncAccelerator.yml b/.github/workflows/syncAccelerator.yml
index 2c2c63b..e114176 100644
--- a/.github/workflows/syncAccelerator.yml
+++ b/.github/workflows/syncAccelerator.yml
@@ -26,7 +26,7 @@
       steps:
 
         - name: Local repository checkout
-          uses: actions/checkout@v3
+          uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
           with:
             path: ${{ github.repository }}
             fetch-depth: 0
diff --git a/.github/workflows/syncAzGovViz.yml b/.github/workflows/syncAzGovViz.yml
index a942dd2..597ad39 100644
--- a/.github/workflows/syncAzGovViz.yml
+++ b/.github/workflows/syncAzGovViz.yml
@@ -26,7 +26,7 @@ jobs:
     if: (${{ github.event.workflow_run.conclusion == 'success' }} || ${{github.event_name == 'workflow_dispatch'}} || ${{github.event_name == 'schedule'}}) && ${{ github.repository != 'Azure/Azure-Governance-Visualizer-Accelerator' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: UpdateAzGovVizAutomatically
         continue-on-error: true