From 59351c63d33dd3a7049264405a642d8add0644f2 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Sat, 5 Sep 2026 23:03:14 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml              |  2 ++
 .github/workflows/expectations.yml  |  2 +-
 .github/workflows/publish.site.yml  | 12 ++++++------
 .github/workflows/rules.github.yaml |  8 ++++----
 4 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b18fd29..f041998 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,5 @@ updates:
     directory: '/'
     schedule:
       interval: 'weekly'
+    cooldown:
+      default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/expectations.yml b/.github/workflows/expectations.yml
index 12419fe..ad8e101 100644
--- a/.github/workflows/expectations.yml
+++ b/.github/workflows/expectations.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Checkout Repository
         id:   checkout_repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Comment on Community PRs
         uses: MicrosoftDocs/PowerShell-Docs/.github/actions/commenting/expectations/v1@main
diff --git a/.github/workflows/publish.site.yml b/.github/workflows/publish.site.yml
index 33bc69a..981f89c 100644
--- a/.github/workflows/publish.site.yml
+++ b/.github/workflows/publish.site.yml
@@ -21,17 +21,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
       - name: Setup Pages
         id:   pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
         with:
           enablement: true
       - name: Setup Hugo
         id:   hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
           hugo-version: 0.129.0
           extended:     true
@@ -53,7 +53,7 @@ jobs:
       #     cd ..
       - name: Setup PowerShell module cache
         id: cacher
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: '~/.local/share/powershell/Modules'
           key: ${{ runner.os }}-dsc-samples
@@ -71,7 +71,7 @@ jobs:
         run: |
           Invoke-Build -Task BuildSite -SiteBaseUrl "${{ steps.pages.outputs.base_url }}/"
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./.site/public
   # Deployment job
@@ -85,4 +85,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/rules.github.yaml b/.github/workflows/rules.github.yaml
index c0756e8..ef0f17b 100644
--- a/.github/workflows/rules.github.yaml
+++ b/.github/workflows/rules.github.yaml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Analyze repository
-        uses: microsoft/ps-rule@v2.9.0
+        uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
         with:
           modules: "PSRule.Rules.GitHub"
   analyze_msft_oss:
@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run PSRule analysis
-        uses: microsoft/ps-rule@v2.9.0
+        uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
         with:
           modules: "PSRule.Rules.MSFT.OSS"
           prerelease: true