From 3c88b98a45527e5ed375177e5390e110b3897746 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 18 Aug 2026 21:11:48 -0400
Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml   | 11 +++++++++++
 .github/workflows/ci.yml |  4 ++--
 2 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..2c48305b7eb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c860ebe3a63..34426a5fc5e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,10 +26,10 @@ jobs:
         run: git config --global core.autocrlf false
         if: matrix.os == 'windows-latest'
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       # https://github.com/actions/cache/blob/main/examples.md#rust---cargo
       # Depends on `Cargo.lock` --> Has to be after checkout.
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/bin/

From 4fd5b14934ae6f58a917f83f62344fe13dae496c Mon Sep 17 00:00:00 2001
From: Leonard Hecker <leonard@hecker.io>
Date: Wed, 19 Aug 2026 15:36:21 +0200
Subject: [PATCH 2/2] Upgrade, Fix CodeQL

---
 .github/workflows/ci.yml     | 7 +++++--
 .github/workflows/winget.yml | 3 +++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 34426a5fc5e..ce296b3927d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -26,10 +29,10 @@ jobs:
         run: git config --global core.autocrlf false
         if: matrix.os == 'windows-latest'
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # https://github.com/actions/cache/blob/main/examples.md#rust---cargo
       # Depends on `Cargo.lock` --> Has to be after checkout.
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/bin/
diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
index 949ef9a5009..d2f6abc0892 100644
--- a/.github/workflows/winget.yml
+++ b/.github/workflows/winget.yml
@@ -1,5 +1,8 @@
 name: Submit release to the WinGet community repository
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]