From 54bff61a76b171d79aa1a4fe70a544f0977b50e2 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Sun, 23 Aug 2026 13:39:21 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/actions/aml-endpoint-deploy/action.yaml |  2 +-
 .github/dependabot.yml                          | 11 +++++++++++
 .github/workflows/workshop_cd.yml               |  6 +++---
 .github/workflows/workshop_ci.yml               |  6 +++---
 .github/workflows/workshop_unit_test.yml        |  6 +++---
 5 files changed, 21 insertions(+), 10 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/actions/aml-endpoint-deploy/action.yaml b/.github/actions/aml-endpoint-deploy/action.yaml
index f37c4b43..37cece16 100644
--- a/.github/actions/aml-endpoint-deploy/action.yaml
+++ b/.github/actions/aml-endpoint-deploy/action.yaml
@@ -119,7 +119,7 @@ runs:
         az ml online-deployment get-logs --name $STAGING_DEPLOYMENT_NAME --endpoint-name $ENDPOINT_NAME >> logs/$ENDPOINT_NAME_$STAGING_DEPLOYMENT_NAME.log
 
     - name: Upload deployment logs
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       if: ${{ (failure() || success()) }}
       with:
         name: deployment-logs
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/workshop_cd.yml b/.github/workflows/workshop_cd.yml
index df3e7214..23616ab4 100644
--- a/.github/workflows/workshop_cd.yml
+++ b/.github/workflows/workshop_cd.yml
@@ -15,10 +15,10 @@ jobs:
     steps:
 
       - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Setup python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: '3.8'
 
@@ -29,7 +29,7 @@ jobs:
           python -m pip install --upgrade twine
 
       - name: AZ Login
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           creds: ${{ secrets.AZURE_SERVICE_PRINCIPAL }} #setup replace AZURE_SERVICE_PRINCIPAL with the name of your Azure credentials secret in GitHub
 
diff --git a/.github/workflows/workshop_ci.yml b/.github/workflows/workshop_ci.yml
index 66a2799a..13a10a0c 100644
--- a/.github/workflows/workshop_ci.yml
+++ b/.github/workflows/workshop_ci.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Setup python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: '3.8' # Version range or exact version of a Python version to use, using SemVer's version range syntax 
       - name: Upgrade pip
@@ -25,7 +25,7 @@ jobs:
           python -m pip install --upgrade build
           python -m pip install --upgrade twine
       - name: AZ Login
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           creds: ${{ secrets.AZURE_SERVICE_PRINCIPAL }}   #setup: provide your Azure credentials name stored in github
 
diff --git a/.github/workflows/workshop_unit_test.yml b/.github/workflows/workshop_unit_test.yml
index fe6dcd59..badf7a06 100644
--- a/.github/workflows/workshop_unit_test.yml
+++ b/.github/workflows/workshop_unit_test.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Setup python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: '3.8' # Version range or exact version of a Python version to use, using SemVer's version range syntax 
       - name: Upgrade pip
@@ -25,7 +25,7 @@ jobs:
           python -m pip install --upgrade build
           python -m pip install --upgrade twine
       - name: AZ Login
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           creds: ${{ secrets.AZURE_SERVICE_PRINCIPAL }} # SETUP: replace AZURE_SERVICE_PRINCIPAL with your own secret name    
       - name: Install AZ ML and tools