Pin GitHub Actions to full-length commit SHAs

[Dan Fiedler (danfiedler-msft)]

Summary

This PR pins GitHub Actions to full-length commit SHAs for improved security and reproducibility and adds a 7 day cooldown to Dependabot configuration for GitHub Actions. This work is described in more detail at https://aka.ms/action-pinning.

Why?

Pinning actions to commit SHAs prevents supply-chain attacks where a tag could be moved to point to malicious code. This is a recommended security best practice per the GitHub Actions security hardening guide.

This change mitigates the risk of tag retargeting to malicious code as seen in incidents like the tj-actions/changed-files action compromise or codfish/semantic-release-action compromise and improves the integrity and reproducibility of the CI/CD pipeline.

What changed?

Action pinning: Third-party action references in .github/workflows/ that used mutable tag-based references (e.g., actions/checkout@v4) have been updated to full-length commit SHAs with a version comment (e.g., actions/checkout@<sha> # v4) using the pinact tool. References that were already pinned to a SHA, or that used immutable release tags, were left unchanged.

Dependabot configuration: .github/dependabot.yml has been updated to ensure a github-actions package-ecosystem section is present with a cooldown configuration (default-days: 7). If the file did not exist, it was created. If a github-actions section already existed, only the cooldown block was added or its default-days value was increased to 7 if it was lower. The 7-day cooldown provides a window for the community to detect and report compromised releases before they are automatically proposed as updates, reducing exposure to supply-chain attacks via newly published malicious versions.

Is this safe to merge?

Yes. The pinned SHAs correspond to the same commits that the existing tags pointed to. No behavioral changes in action execution are introduced. You can verify the pinned SHA value using the GitHub REST API (e.g., the commit hash for actions/checkout@v7 can be found in the sha property in the JSON response for GET https://api.github.com/repos/actions/checkout/commits/v7).

Additional Information

For more information, please see https://aka.ms/action-pinning

[azure-pipelines]

Azure Pipelines:
7 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution Dan Fiedler (@danfiedler-msft)! We will review the pull request and get back to you soon.

[Copilot]

Pull request overview

Pins third-party GitHub Actions to verified commit SHAs and configures a seven-day Dependabot cooldown. Two modified workflows still need explicit least-privilege permissions.

Changes:

• Pins workflow and composite-action dependencies to full SHAs.
• Adds grouped weekly Dependabot updates with a seven-day cooldown.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/vscode-ci.yml	Pins VS Code CI actions.
.github/workflows/verify-ext-providers.yml	Pins checkout and Go setup.
.github/workflows/validate-go-version.yml	Pins checkout.
.github/workflows/validate-go-dependency-versions.yml	Pins checkout and Go setup.
.github/workflows/test-ext-azure-ai-agents.yml	Pins agent test actions.
.github/workflows/stale-issues.yml	Pins the stale action.
.github/workflows/scripts-ci.yml	Pins script CI actions.
.github/workflows/schema-ci.yml	Pins schema CI actions.
.github/workflows/pr-governance.yml	Pins governance actions.
.github/workflows/lint-go.yml	Pins Go lint actions.
.github/workflows/lint-bicep.yml	Pins checkout; lacks explicit permissions.
.github/workflows/ext-registry-ci.yml	Pins extension registry CI actions.
.github/workflows/ext-registry-check.yml	Pins registry-check actions.
.github/workflows/devops-ext-ci.yml	Pins DevOps extension CI actions.
.github/workflows/devcontainer-feature-test.yml	Pins checkout; lacks explicit permissions.
.github/workflows/devcontainer-feature-release.yml	Pins release actions.
.github/workflows/cspell-misc.yml	Pins spelling-check actions.
.github/workflows/cspell-ext.yml	Pins extension spelling-check actions.
.github/workflows/copilot-setup-steps.yml	Pins environment setup actions.
.github/workflows/cli-ci.yml	Pins CLI CI actions.
.github/workflows/actionlint.yml	Pins checkout.
.github/dependabot.yml	Adds weekly grouped updates and cooldown.
.github/actions/vally-eval/action.yml	Pins Vally composite-action dependencies.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Victor Vazquez (vhvb1989)]

Chidozie Ononiwu (@chidozieononiwu) can you take a look to this one?

[hemarina]

LGTM

[hemarina]

Dan Fiedler (@danfiedler-msft) Do we want to apply the 7 days rule also on npm packages?

[microsoft-github-policy-service]

Hi @Dan Fiedler (@danfiedler-msft). Thank you for your interest in helping to improve the Azure Developer CLI experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days.

[hemarina]

The vally pipeline is failing for fork. Will handle this in #10009. Dan Fiedler (@danfiedler-msft) Feel free to ping me if you have any questions.