From 9ff7f716193a49298dc223b41399d716b9b430dc Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Sun, 23 Aug 2026 21:45:09 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 4 +++- .github/workflows/analyze.yaml | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e6907f30..196ef152 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,6 +16,8 @@ updates: - 'ci-quality' reviewers: - 'microsoft/psrule' + cooldown: + default-days: 7 # Maintain dependencies for npm - package-ecosystem: 'npm' @@ -25,4 +27,4 @@ updates: labels: - 'dependencies' reviewers: - - 'microsoft/psrule' + - 'microsoft/psrule' \ No newline at end of file diff --git a/.github/workflows/analyze.yaml b/.github/workflows/analyze.yaml index d85d1066..df70c50a 100644 --- a/.github/workflows/analyze.yaml +++ b/.github/workflows/analyze.yaml @@ -32,7 +32,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Run PSRule analysis - uses: microsoft/ps-rule@v2.9.0 + uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0 with: modules: PSRule.Rules.MSFT.OSS prerelease: true