From f3b2a1db816396e822799dc8ec3aa5dec7b823b5 Mon Sep 17 00:00:00 2001
From: OssSecurityBot <oss-security-bot@microsoft.com>
Date: Thu, 9 Jul 2026 11:43:58 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                | 2 ++
 .github/workflows/codeql-analysis.yml | 8 ++++----
 .github/workflows/dotnet-format.yml   | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index da341d0f6..f07fdeaae 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,8 @@ updates:
     # reviewers:
     #   - reviewer_one
 
+    cooldown:
+      default-days: 7
   - package-ecosystem: 'gitsubmodule'
     directory: ''
     open-pull-requests-limit: 10
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index cad32b9ec..d1b334e81 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,15 +18,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
           dotnet-version: 9.0.x
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
         with:
           queries: security-and-quality
           languages: csharp
@@ -57,5 +57,5 @@ jobs:
           --no-restore
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
 # Built with ❤ by [Pipeline Foundation](https://pipeline.foundation)
diff --git a/.github/workflows/dotnet-format.yml b/.github/workflows/dotnet-format.yml
index 34135b822..55b08a38c 100644
--- a/.github/workflows/dotnet-format.yml
+++ b/.github/workflows/dotnet-format.yml
@@ -10,7 +10,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
     - name: dotnet format
       run: dotnet format src --verify-no-changes
\ No newline at end of file