From debec4c78a7abbcd685fd4d0e1cd4da48a3dd277 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Fri, 28 Aug 2026 18:25:02 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml             | 11 +++++++++++
 .github/workflows/publish.yml      |  4 ++--
 .github/workflows/test-emitter.yml |  6 +++---
 .github/workflows/test-sdk.yml     |  6 +++---
 4 files changed, 19 insertions(+), 8 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..2c48305b7eb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 054be7308e0..d76c3abc72e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Azure login
-      uses: azure/login@v2
+      uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
       with:
         client-id: ${{ secrets.ADO_SP_ClientID }}
         tenant-id: ${{ secrets.ADO_SP_TenantID }}
@@ -21,7 +21,7 @@ jobs:
         enable-AzPSSession: true
 
     - name: Call Azure Pipeline to Publish
-      uses: azure/powershell@v2
+      uses: azure/powershell@53dd145408794f7e80f97cfcca04155c85234709 # v2.0.0
       env: 
         AdoOrg: ${{secrets.ADO_ORGANIZATION}}
         AdoProject: ${{secrets.ADO_PROJECT}}
diff --git a/.github/workflows/test-emitter.yml b/.github/workflows/test-emitter.yml
index 86f0fe4a994..4862d13e78c 100644
--- a/.github/workflows/test-emitter.yml
+++ b/.github/workflows/test-emitter.yml
@@ -9,9 +9,9 @@ jobs:
      runs-on: windows-latest
      steps:
        - name: Checkout
-         uses: actions/checkout@v4
+         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        - name: Install Node.js 20
-         uses: actions/setup-node@v4
+         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
          with:
            node-version: 20.x
        - name: Install typespec & rush
@@ -34,7 +34,7 @@ jobs:
            ./EmitterTest.ps1 -AllowList -SaveResult
        - name: Save artifacts
          if: always()
-         uses: actions/upload-artifact@v4
+         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
          with:
            name: CompareResult
            path: tests-upgrade/tests-emitter/CompareResult
diff --git a/.github/workflows/test-sdk.yml b/.github/workflows/test-sdk.yml
index 3059934cb26..d5ca91eb615 100644
--- a/.github/workflows/test-sdk.yml
+++ b/.github/workflows/test-sdk.yml
@@ -9,9 +9,9 @@ jobs:
      runs-on: ubuntu-latest
      steps:
        - name: Checkout
-         uses: actions/checkout@v4
+         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        - name: Install Node.js 18
-         uses: actions/setup-node@v4
+         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
          with:
            node-version: 18.x
        - name: Install autorest & rush
@@ -34,7 +34,7 @@ jobs:
            ./AutoRestSupportSdkTest.ps1 -AllowList -SkipCsharp
        - name: Save artifacts
          if: always()
-         uses: actions/upload-artifact@v4
+         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
          with:
            name: CompareResult
            path: tests-upgrade/tests-sdk1-support/CompareResult