Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -7,4 +7,13 @@ updates:
     target-branch: "develop"
     labels:
       - "dependencies"
-      - "python"
+      - "python"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/block-pr-to-main.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: Post comment on open or reopen
         if: github.event.action == 'opened' || github.event.action == 'reopened'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const body = `## ⛔ Pull requests to \`main\` are not allowed

.github/workflows/copilot-setup-steps.yml

@@ -21,7 +21,7 @@ jobs:
       AZURE_PRINCIPAL_ID: f4be7297-7532-4582-b0b5-53e7413879dd
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           submodules: recursive
 
@@ -31,7 +31,7 @@ jobs:
           version: 1.28.1
 
       - name: Sign in to Azure with GitHub OIDC
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}

.github/workflows/deploy-docs.yml

@@ -25,13 +25,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           ref: docs
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.11
 

.github/workflows/validate-agentic-assets.yml

@@ -30,7 +30,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Install validator dependencies
         run: python -m pip install --disable-pip-version-check -r .github/scripts/requirements.txt
       - name: Validate agents, skills, and scoped instructions