From aff777134c6b42e13b7c3f9d7bbda150a5506f45 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Tue, 18 Aug 2026 13:28:48 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 9 +++++ .github/workflows/changesets-version.yml | 8 ++--- .github/workflows/codeql-analysis.yml | 8 ++--- .github/workflows/pr.yml | 44 ++++++++++++------------ 4 files changed, 39 insertions(+), 30 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d31a9cde192..3a164b7fa1e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -36,3 +36,12 @@ updates: labels: - 'Type: Dependencies' versioning-strategy: lockfile-only + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/changesets-version.yml b/.github/workflows/changesets-version.yml index a8570b92cf3..f17d52ea48c 100644 --- a/.github/workflows/changesets-version.yml +++ b/.github/workflows/changesets-version.yml @@ -13,21 +13,21 @@ jobs: if: ${{ github.repository == 'microsoft/fluentui-react-native' }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: filter: blob:none fetch-depth: 0 persist-credentials: false - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 - name: Install dependencies run: | yarn install --immutable - name: Generate token for version PR - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 id: app-token with: app-id: ${{ vars.APP_ID }} @@ -37,7 +37,7 @@ jobs: - name: Create Version Bump PR id: changesets - uses: changesets/action@v1 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 with: version: yarn changeset:version createGithubReleases: false diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index aa72be2da9f..234d60fd5f9 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -39,11 +39,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -54,7 +54,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -68,4 +68,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7 diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 4c4478d4e4f..ece92932149 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -19,12 +19,12 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: node-version: 22 @@ -40,10 +40,10 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: platform: android node-version: 22 @@ -70,10 +70,10 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: platform: macos node-version: 22 @@ -112,7 +112,7 @@ jobs: - name: Upload E2E macOS artifacts if: ${{ always() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: E2E_macos_Dump path: | @@ -125,10 +125,10 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: platform: ios node-version: 22 @@ -170,12 +170,12 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 5 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: platform: windows node-version: 22 @@ -223,7 +223,7 @@ jobs: - name: Upload E2E Windows artifacts if: ${{ always() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: E2E_RNW_Dump path: | @@ -237,10 +237,10 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: platform: windows node-version: 22 @@ -272,7 +272,7 @@ jobs: - name: Upload E2E Win32 artifacts if: ${{ always() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: E2E_win32_Dump path: | @@ -287,13 +287,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: filter: blob:none fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '22' cache: 'yarn' @@ -315,10 +315,10 @@ jobs: has-tarballs: ${{ steps.check.outputs.has-tarballs }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: node-version: 22 @@ -343,7 +343,7 @@ jobs: - name: Upload packed tarballs if: steps.check.outputs.has-tarballs == 'true' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: packed-tarballs-dry-run path: _packed/ @@ -354,10 +354,10 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up toolchain - uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@5.2.3 + uses: microsoft/react-native-test-app/.github/actions/setup-toolchain@1230975885a9e5d3a2ad58b1483f80b09cec04f2 # 5.2.3 with: node-version: 22 From 310daaba98658d655cf24652b92c4d812187fa47 Mon Sep 17 00:00:00 2001 From: Jason Morse Date: Tue, 18 Aug 2026 14:11:41 -0700 Subject: [PATCH 2/2] add formatting changes --- .github/dependabot.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3a164b7fa1e..412a3e859cd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -36,12 +36,12 @@ updates: labels: - 'Type: Dependencies' versioning-strategy: lockfile-only - - package-ecosystem: "github-actions" - directory: "/" + - package-ecosystem: 'github-actions' + directory: '/' groups: github-actions: - patterns: ["*"] + patterns: ['*'] schedule: - interval: "weekly" + interval: 'weekly' cooldown: default-days: 7