From 432e4931fefc1b56d99f878eb2b5665a5c6b59dd Mon Sep 17 00:00:00 2001
From: GitHub Security Bot
 <88103841+github-security-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:29:58 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml                             | 2 ++
 .github/workflows/add-dependabot-pr-to-project.yml | 2 +-
 .github/workflows/generate-dependabot.yml          | 2 +-
 .github/workflows/main.yml                         | 8 ++++----
 .github/workflows/release.yml                      | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 01d08545..095d351a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,3 +18,5 @@ updates:
     schedule:
       interval: daily
     open-pull-requests-limit: 20
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/add-dependabot-pr-to-project.yml b/.github/workflows/add-dependabot-pr-to-project.yml
index 235260e7..5222ca02 100644
--- a/.github/workflows/add-dependabot-pr-to-project.yml
+++ b/.github/workflows/add-dependabot-pr-to-project.yml
@@ -15,7 +15,7 @@ jobs:
     name: Add to Compute Foundation Project Board
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/github/projects/5753/ # Compute Foundation Project Board
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
diff --git a/.github/workflows/generate-dependabot.yml b/.github/workflows/generate-dependabot.yml
index c623bc1d..671a818b 100644
--- a/.github/workflows/generate-dependabot.yml
+++ b/.github/workflows/generate-dependabot.yml
@@ -14,7 +14,7 @@ jobs:
   generate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Generate dependabot.yml
         uses: Makeshift/generate-dependabot-glob-action@5cd45385ce6519f68d574aab9699832b3a5e5031 # v1.3.4
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c54fbf97..4d6cddba 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -16,7 +16,7 @@ jobs:
         ruby-version: ["2.6"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Build container
         run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}} --build-arg PUPPET_VERSION=${{env.PUPPET_VERSION}}
       - name: Tests
@@ -37,7 +37,7 @@ jobs:
         ruby-version: ["2.6"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Build container
         run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}} --build-arg PUPPET_VERSION=${{env.PUPPET_VERSION}}
       - name: Tests
@@ -58,7 +58,7 @@ jobs:
         ruby-version: ["2.6"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Build container
         run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}} --build-arg PUPPET_VERSION=${{env.PUPPET_VERSION}}
       - name: Tests
@@ -79,7 +79,7 @@ jobs:
         ruby-version: ["2.6"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Build container
         run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}} --build-arg PUPPET_VERSION=${{env.PUPPET_VERSION}}
       - name: Tests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2cb947a2..3dce4f64 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
       packages: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Set up Ruby
         uses: ruby/setup-ruby@a6b46b8a08edb18935835849f2a17072d5cc8c73 # v1.192.0
         with: