Pin GitHub Actions to commit SHAs - #9800
Conversation
Pin repository workflows, composite actions, and the generated Copilot workflow template to immutable commits. Configure Dependabot to delay GitHub Actions updates for seven days. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 1 pipeline(s). 20 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 20 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
Pull request overview
Pins GitHub Actions to immutable SHAs and adds Dependabot maintenance.
Changes:
- Pins workflow and template action references.
- Adds readable version comments.
- Enables daily Dependabot checks with cooldown.
Reviewed changes
Copilot reviewed 25 out of 25 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
cli/azd/extensions/azure.coding-agent/internal/cmd/templates/copilot-setup-steps.yml |
Pins generated setup action. |
.github/workflows/vscode-ci.yml |
Pins VS Code CI actions. |
.github/workflows/verify-ext-providers.yml |
Pins provider verification actions. |
.github/workflows/validate-go-version.yml |
Pins checkout action. |
.github/workflows/validate-go-dependency-versions.yml |
Pins dependency validation actions. |
.github/workflows/test-ext-azure-ai-agents.yml |
Pins extension test actions. |
.github/workflows/stale-issues.yml |
Pins stale-issue action. |
.github/workflows/scripts-ci.yml |
Pins scripts CI actions. |
.github/workflows/schema-ci.yml |
Pins schema CI actions. |
.github/workflows/pr-governance.yml |
Pins governance actions. |
.github/workflows/lint-go.yml |
Pins Go lint actions. |
.github/workflows/lint-bicep.yml |
Pins checkout action. |
.github/workflows/ext-registry-ci.yml |
Pins registry CI actions. |
.github/workflows/ext-registry-check.yml |
Pins registry-check actions. |
.github/workflows/event.yml |
Pins Azure SDK event action. |
.github/workflows/devops-ext-ci.yml |
Pins extension CI actions. |
.github/workflows/devcontainer-feature-test.yml |
Pins checkout actions. |
.github/workflows/devcontainer-feature-release.yml |
Pins release actions. |
.github/workflows/cspell-misc.yml |
Pins spelling-check actions. |
.github/workflows/cspell-ext.yml |
Pins extension spelling actions. |
.github/workflows/copilot-setup-steps.yml |
Pins Copilot setup actions. |
.github/workflows/cli-ci.yml |
Pins CLI CI actions. |
.github/workflows/actionlint.yml |
Pins checkout action. |
.github/dependabot.yml |
Adds action update scheduling. |
.github/actions/vally-eval/action.yml |
Pins composite-action dependencies. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Expand Dependabot coverage to nonstandard action manifests and pin the actions emitted by azd pipeline config. Regenerate the affected pipeline snapshots. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 31 out of 31 changed files in this pull request and generated 2 comments.
Suppressed comments (1)
cli/azd/resources/pipeline/.github/azure-dev.ymlt:53
- This SHA belongs to
actions/checkout@v4.4.0, so the optional Aspire setup step cannot resolveactions/setup-dotnetand the generated workflow fails. Swap in the actual setup-dotnet v4.3.1 SHA used mistakenly on line 42.
Load generated workflow action pins from a Dependabot-managed YAML manifest and validate action repositories and full commit SHAs before rendering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
|
Is this similar to #9786 ? Seems like the same title |
Nice catch. I'm closing this PR. |
Fixes #9802
Summary
actions/checkout@v7.0.1and update the other changed actions to their latest stable releasesvally-evalcomposite action, the generated Copilot setup workflow, and the workflow emitted byazd pipeline configAzure/azure-sdk-actionsdoes not publish releases or tags, so its currentmaincommit is pinned directly.Validation
actionlintv1.7.12 on all changed workflows and the generated-pipeline action manifestgo test ./internal/cmd/...incli/azd/extensions/azure.coding-agentgo test ./pkg/pipeline