From 87fd3193ae267285a9bca22c755eaee10e7ccad2 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 12 Aug 2026 12:58:08 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml               | 2 ++
 .github/workflows/close-preview.yml  | 2 +-
 .github/workflows/deploy-preview.yml | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1860f11d5f27..f13d97742955 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,6 +14,8 @@ updates:
       github-actions:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: 'devcontainers'
     directory: '/'
diff --git a/.github/workflows/close-preview.yml b/.github/workflows/close-preview.yml
index 31ff6456111f..98b6c6288021 100644
--- a/.github/workflows/close-preview.yml
+++ b/.github/workflows/close-preview.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'microsoft/TypeScript-Website'
     steps:
-      - uses: Azure/static-web-apps-deploy@v1
+      - uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_PREVIEW }}
           action: close
diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
index f6ec32ddaa33..40c39872355a 100644
--- a/.github/workflows/deploy-preview.yml
+++ b/.github/workflows/deploy-preview.yml
@@ -142,7 +142,7 @@ jobs:
       - name: Deploy
         id: deploy
         if: ${{ steps.get-info.outputs.result != 'null' }}
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_PREVIEW }}
           # Unsetting the repo token so we can control commenting ourselves.