Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -10,3 +10,12 @@ updates:
    directory: "/"
    schedule:
      interval: weekly
+ - package-ecosystem: "github-actions"
+   directory: "/"
+   groups:
+     github-actions:
+       patterns: ["*"]
+   schedule:
+     interval: "weekly"
+   cooldown:
+     default-days: 7

.github/workflows/ai-issue-triage.yml

@@ -30,11 +30,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Resolve issue details
         id: issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const issueNumber = context.payload.issue?.number || ${{ inputs.issue_number || 0 }};
@@ -88,7 +88,7 @@ jobs:
 
       - name: Run AI assessment
         id: ai-assessment
-        uses: github/ai-assessment-comment-labeler@v1.0.1
+        uses: github/ai-assessment-comment-labeler@e3bedc38cfffa9179fe4cee8f7ecc93bffb3fee7 # v1.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           issue_number: ${{ steps.issue.outputs.number }}
@@ -105,7 +105,7 @@ jobs:
 
       - name: Post-process triage results
         if: steps.ai-assessment.outputs.ai_assessments != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           ASSESSMENT_OUTPUT: ${{ steps.ai-assessment.outputs.ai_assessments }}
           SUPPRESS_LABELS: ${{ env.SUPPRESS_LABELS }}
@@ -219,7 +219,7 @@ jobs:
 
       - name: Generate triage summary
         if: always() && steps.ai-assessment.outputs.ai_assessments != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           ASSESSMENT_OUTPUT: ${{ steps.ai-assessment.outputs.ai_assessments }}
           LABEL_DECISIONS: ${{ env.LABEL_DECISIONS }}
@@ -272,7 +272,7 @@ jobs:
 
       - name: Upload triage report
         if: always() && steps.ai-assessment.outputs.ai_assessments != ''
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: triage-report-issue-${{ steps.issue.outputs.number }}
           path: triage-reports/

.github/workflows/changelog-existence.yml

@@ -31,13 +31,13 @@ jobs:
       HEAD_SHA: ${{ github.event.pull_request.head.sha }}
     steps:
       - name: ⤵️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0  # Required to access full commit history
 
       - name: ✔️ Check for changelog changes
         id: changelog_check
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             const { execSync } = require('child_process');
@@ -51,7 +51,7 @@ jobs:
 
       - name: 🚧 Setup Node
         if: steps.changelog_check.outputs.exists == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '20'
 

.github/workflows/create-release.yml

@@ -18,7 +18,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0  # Required to access full commit history for validation
 

.github/workflows/documentation.yml

@@ -12,11 +12,11 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
               with:
                   ref: main
             - name: Install Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
               with:
                   python-version: "3.10"
             - name: Install Requirements

.github/workflows/fab-build.yml

@@ -21,10 +21,10 @@ jobs:
     name: Lint Code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.12"  # Use any stable Python version for linting
 
@@ -34,7 +34,7 @@ jobs:
           pip install tox
 
       - name: Cache Tox environments
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: .tox
           key: ${{ runner.os }}-tox-lint-${{ hashFiles('**/tox.toml') }}
@@ -50,10 +50,10 @@ jobs:
     name: Type Check Code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.12"  # Use any stable Python version for type checking
 
@@ -63,7 +63,7 @@ jobs:
           pip install tox
 
       - name: Cache Tox environments
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: .tox
           key: ${{ runner.os }}-tox-type-${{ hashFiles('**/tox.toml') }}
@@ -89,10 +89,10 @@ jobs:
           - python-version: "3.13"
             tox-env: "py313"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -102,7 +102,7 @@ jobs:
           pip install tox
 
       - name: Cache Tox environments
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: .tox
           key: ${{ runner.os }}-tox-${{ matrix.tox-env }}-${{ hashFiles('**/tox.toml') }}
@@ -115,7 +115,7 @@ jobs:
 
       # Upload the coverage report as an artifact
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-html-report-${{ matrix.python-version }}
           path: coverage_html
@@ -127,10 +127,10 @@ jobs:
     needs:
       - test  # Ensure all test jobs complete successfully
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.12"
 

.github/workflows/semantic-pull-request.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       - name: Run Semantic PR Validation
         id: validation
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             const prTitle = context.payload.pull_request.title;
@@ -33,7 +33,7 @@ jobs:
             }
       - name: Handle Invalid Title
         if: failure()
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             const commentMarker = '<!-- semantic-pr-comment -->';
@@ -95,7 +95,7 @@ jobs:
             });
       - name: Handle Valid Title
         if: success()
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             const { data: labels } = await github.rest.issues.listLabelsOnIssue({