From b47e73732cdaa1bce48474c9f03f37b91121dc08 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Fri, 10 Jul 2026 10:32:49 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/actions/build-vsix/action.yml | 4 +- .github/dependabot.yml | 11 ++++ .github/workflows/code-analysis.yml | 8 +-- .../workflows/community-feedback-closer.yml | 2 +- .github/workflows/info-needed-closer.yml | 2 +- .github/workflows/issue-labels.yml | 2 +- .github/workflows/pr-check.yml | 54 +++++++++---------- .github/workflows/push-check.yml | 46 ++++++++-------- .../workflows/test_plan_item_validator.yml | 2 +- .github/workflows/triage-info-needed.yml | 4 +- 10 files changed, 73 insertions(+), 62 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actions/build-vsix/action.yml b/.github/actions/build-vsix/action.yml index d17a03ac..f5fc67ca 100644 --- a/.github/actions/build-vsix/action.yml +++ b/.github/actions/build-vsix/action.yml @@ -10,7 +10,7 @@ runs: using: 'composite' steps: - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ inputs.node_version }} cache: 'npm' @@ -24,7 +24,7 @@ runs: shell: bash - name: Upload VSIX - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: vsix path: ms-python-envs-insiders.vsix diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index 53b5ced6..cee2bae8 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -13,17 +13,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 # Full history for git analysis - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.12' - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 - name: Install analysis dependencies working-directory: analysis @@ -35,7 +35,7 @@ jobs: python -m analysis.snapshot --output analysis-snapshot.json - name: Upload snapshot artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: code-health-snapshot-${{ github.sha }} path: analysis-snapshot.json diff --git a/.github/workflows/community-feedback-closer.yml b/.github/workflows/community-feedback-closer.yml index a6c0904f..d2304cf1 100644 --- a/.github/workflows/community-feedback-closer.yml +++ b/.github/workflows/community-feedback-closer.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Close community feedback issues lacking upvotes - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const label = 'needs community feedback'; diff --git a/.github/workflows/info-needed-closer.yml b/.github/workflows/info-needed-closer.yml index 77dea5e0..caf678d6 100644 --- a/.github/workflows/info-needed-closer.yml +++ b/.github/workflows/info-needed-closer.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/vscode-github-triage-actions' path: ./actions diff --git a/.github/workflows/issue-labels.yml b/.github/workflows/issue-labels.yml index 5005b4a3..c46e20b0 100644 --- a/.github/workflows/issue-labels.yml +++ b/.github/workflows/issue-labels.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/vscode-github-triage-actions' ref: stable diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml index 17f8a97f..1298ffa0 100644 --- a/.github/workflows/pr-check.yml +++ b/.github/workflows/pr-check.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Build VSIX uses: ./.github/actions/build-vsix @@ -30,10 +30,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -54,10 +54,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -86,10 +86,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Checkout Python Environment Tools - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/python-environment-tools' path: 'python-env-tools-src' @@ -103,7 +103,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Cache Rust build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/registry @@ -132,13 +132,13 @@ jobs: shell: bash - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -153,7 +153,7 @@ jobs: - name: Run Smoke Tests (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run smoke-test @@ -173,10 +173,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Checkout Python Environment Tools - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/python-environment-tools' path: 'python-env-tools-src' @@ -190,7 +190,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Cache Rust build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/registry @@ -219,13 +219,13 @@ jobs: shell: bash - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -240,7 +240,7 @@ jobs: - name: Run E2E Tests (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run e2e-test @@ -260,10 +260,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Checkout Python Environment Tools - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/python-environment-tools' path: 'python-env-tools-src' @@ -277,7 +277,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Cache Rust build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/registry @@ -306,13 +306,13 @@ jobs: shell: bash - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -327,7 +327,7 @@ jobs: - name: Run Integration Tests (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run integration-test @@ -347,16 +347,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -371,7 +371,7 @@ jobs: - name: Run Integration Tests Multi-Root (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run integration-test-multiroot diff --git a/.github/workflows/push-check.yml b/.github/workflows/push-check.yml index a0dab018..96867be2 100644 --- a/.github/workflows/push-check.yml +++ b/.github/workflows/push-check.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Build VSIX uses: ./.github/actions/build-vsix @@ -31,10 +31,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -55,10 +55,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -87,10 +87,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Checkout Python Environment Tools - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/python-environment-tools' path: 'python-env-tools-src' @@ -104,7 +104,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Cache Rust build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/registry @@ -133,13 +133,13 @@ jobs: shell: bash - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -154,7 +154,7 @@ jobs: - name: Run Smoke Tests (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run smoke-test @@ -174,10 +174,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Checkout Python Environment Tools - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/python-environment-tools' path: 'python-env-tools-src' @@ -191,7 +191,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Cache Rust build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/registry @@ -220,13 +220,13 @@ jobs: shell: bash - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -241,7 +241,7 @@ jobs: - name: Run E2E Tests (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run e2e-test @@ -261,10 +261,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Checkout Python Environment Tools - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/python-environment-tools' path: 'python-env-tools-src' @@ -278,7 +278,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Cache Rust build - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/registry @@ -307,13 +307,13 @@ jobs: shell: bash - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' - name: Install Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ matrix.python-version }} @@ -328,7 +328,7 @@ jobs: - name: Run Integration Tests (Linux) if: runner.os == 'Linux' - uses: GabrielBB/xvfb-action@v1 + uses: GabrielBB/xvfb-action@86d97bde4a65fe9b290c0b3fb92c2c4ed0e5302d # v1.6 with: run: npm run integration-test diff --git a/.github/workflows/test_plan_item_validator.yml b/.github/workflows/test_plan_item_validator.yml index 91e8948c..da6eeeb1 100644 --- a/.github/workflows/test_plan_item_validator.yml +++ b/.github/workflows/test_plan_item_validator.yml @@ -12,7 +12,7 @@ jobs: if: contains(github.event.issue.labels.*.name, 'testplan-item') || contains(github.event.issue.labels.*.name, 'invalid-testplan-item') steps: - name: Checkout Actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/vscode-github-triage-actions' path: ./actions diff --git a/.github/workflows/triage-info-needed.yml b/.github/workflows/triage-info-needed.yml index 1fd316f6..c5c18042 100644 --- a/.github/workflows/triage-info-needed.yml +++ b/.github/workflows/triage-info-needed.yml @@ -15,7 +15,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/vscode-github-triage-actions' ref: stable @@ -39,7 +39,7 @@ jobs: issues: write steps: - name: Checkout Actions - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: 'microsoft/vscode-github-triage-actions' ref: stable