From 3cc14f72b1f58fdbb256f954448aee00c283e713 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Sat, 5 Sep 2026 21:01:21 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yaml                    |  2 ++
 .github/workflows/app-tests.yaml           | 10 +++++-----
 .github/workflows/bicep-security-scan.yaml |  6 +++---
 .github/workflows/python-code-quality.yaml |  4 ++--
 4 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 4e3c727..d7dd8f2 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -15,6 +15,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "npm"
     directory: "/app/frontend"
diff --git a/.github/workflows/app-tests.yaml b/.github/workflows/app-tests.yaml
index 373e2af..9fb50ea 100644
--- a/.github/workflows/app-tests.yaml
+++ b/.github/workflows/app-tests.yaml
@@ -40,7 +40,7 @@ jobs:
       POSTGRES_DATABASE: postgres
       POSTGRES_SSL: disable
     steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
         - name: (MacOS) Install postgreSQL and pgvector using brew
           if: matrix.os == 'macos-26'
@@ -78,13 +78,13 @@ jobs:
             sudo -u postgres psql -c 'CREATE EXTENSION vector'
 
         - name: Setup python
-          uses: actions/setup-python@v6
+          uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
           with:
             python-version: ${{ matrix.python_version }}
             architecture: x64
 
         - name: Install uv
-          uses: astral-sh/setup-uv@v6
+          uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
           with:
             enable-cache: true
             version: "0.4.20"
@@ -105,7 +105,7 @@ jobs:
             python ./src/backend/fastapi_app/setup_postgres_seeddata.py
 
         - name: Setup node
-          uses: actions/setup-node@v5
+          uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
           with:
             node-version: 18
 
@@ -129,7 +129,7 @@ jobs:
 
         - name: Upload test artifacts
           if: ${{ failure() && steps.e2e.conclusion == 'failure' }}
-          uses: actions/upload-artifact@v4
+          uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
           with:
             name: playwright-traces${{ matrix.python_version }}
             path: test-results
diff --git a/.github/workflows/bicep-security-scan.yaml b/.github/workflows/bicep-security-scan.yaml
index 5379309..22d1c00 100644
--- a/.github/workflows/bicep-security-scan.yaml
+++ b/.github/workflows/bicep-security-scan.yaml
@@ -17,10 +17,10 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Build Bicep for linting
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           inlineScript: |
             export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
@@ -34,7 +34,7 @@ jobs:
           tools: templateanalyzer
 
       - name: Upload alerts to Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         if: github.repository == 'Azure-Samples/azure-search-openai-demo'
         with:
           sarif_file: ${{ steps.msdo.outputs.sarifFile }}
diff --git a/.github/workflows/python-code-quality.yaml b/.github/workflows/python-code-quality.yaml
index bbf9d00..06cd744 100644
--- a/.github/workflows/python-code-quality.yaml
+++ b/.github/workflows/python-code-quality.yaml
@@ -20,9 +20,9 @@ jobs:
   checks-format-and-lint:
     runs-on: ubuntu-latest
     steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         - name: Set up Python 3
-          uses: actions/setup-python@v6
+          uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
           with:
             python-version: "3.12"
             cache: 'pip'