From 628b81455a987f53e084f23c6501949c632e8cf5 Mon Sep 17 00:00:00 2001 From: Mike Harder Date: Tue, 1 Sep 2026 17:23:32 -0700 Subject: [PATCH 1/5] Pin GitHub Actions to full-length commit SHAs --- .github/workflows/post-apiview.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/post-apiview.yml b/.github/workflows/post-apiview.yml index 650ca244a567..e47fbdacd792 100644 --- a/.github/workflows/post-apiview.yml +++ b/.github/workflows/post-apiview.yml @@ -24,7 +24,7 @@ jobs: contains(github.event.check_run.name, 'SDK Validation') ) steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: sparse-checkout: "eng/common" From 0a0b78b5704206d5bbd31186dc1b143e92015ca8 Mon Sep 17 00:00:00 2001 From: Mike Harder Date: Tue, 1 Sep 2026 17:23:54 -0700 Subject: [PATCH 2/5] Only trigger on pull_request --- .github/workflows/verify-links.yml | 23 +---------------------- 1 file changed, 1 insertion(+), 22 deletions(-) diff --git a/.github/workflows/verify-links.yml b/.github/workflows/verify-links.yml index f41d380f17ac..462e12e1f87f 100644 --- a/.github/workflows/verify-links.yml +++ b/.github/workflows/verify-links.yml @@ -6,10 +6,6 @@ on: - main - release/* - hotfix/* - check_run: - types: - - completed - workflow_dispatch: permissions: contents: read @@ -17,28 +13,11 @@ permissions: jobs: verify-links: name: Verify Links - if: >- - github.event_name == 'pull_request' || - ( - github.event_name == 'check_run' && - github.event.check_run.check_suite.app.name == 'Azure Pipelines' && - ( - (github.repository == 'Azure/azure-sdk-for-net' && contains(github.event.check_run.name, 'Compliance')) || - (github.repository == 'Azure/azure-sdk-for-python' && contains(github.event.check_run.name, 'Analyze')) || - (github.repository == 'Azure/azure-sdk-for-java' && contains(github.event.check_run.name, 'Analyze')) || - (github.repository == 'Azure/azure-sdk-for-js' && contains(github.event.check_run.name, 'Analyze')) || - (github.repository == 'Azure/azure-sdk-for-cpp' && contains(github.event.check_run.name, 'GenerateReleaseArtifacts')) || - (github.repository == 'Azure/azure-sdk-for-go' && contains(github.event.check_run.name, 'Analyze')) || - (github.repository == 'Azure/azure-sdk-for-ios' && contains(github.event.check_run.name, 'Analyze')) || - (github.repository == 'Azure/azure-sdk-for-rust' && contains(github.event.check_run.name, 'Analyze')) - ) - ) runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: - ref: ${{ github.event.pull_request.head.sha || github.event.check_run.head_sha || github.sha }} fetch-depth: 0 - name: Link verification check From 79ef4ddfef448827c09219f994e173242ba4139d Mon Sep 17 00:00:00 2001 From: Mike Harder Date: Tue, 1 Sep 2026 17:38:59 -0700 Subject: [PATCH 3/5] Pin SHA to azure-sdk-actions repo --- .github/workflows/event.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/event.yml b/.github/workflows/event.yml index 6a973b4277fb..ea91e63cfe37 100644 --- a/.github/workflows/event.yml +++ b/.github/workflows/event.yml @@ -20,6 +20,6 @@ jobs: name: Handle ${{ github.event_name }} ${{ github.event.action }} event runs-on: ubuntu-latest # This image is intentionally set to "latest", and not to a specific version steps: - - uses: azure/azure-sdk-actions@main + - uses: azure/azure-sdk-actions@6a2d61414e790705ab24370421c0a5b04b65de53 # main with: token: ${{ secrets.GITHUB_TOKEN }} From d12973e068079a504b7a1ec8bb71a726816cec1e Mon Sep 17 00:00:00 2001 From: Mike Harder Date: Tue, 1 Sep 2026 17:31:52 -0700 Subject: [PATCH 4/5] Revert "[verify-links.yml] Only trigger on pull_request" This reverts commit 3d9598fba0ec43639ae33f60e4592e5d5915b393. --- .github/workflows/verify-links.yml | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/.github/workflows/verify-links.yml b/.github/workflows/verify-links.yml index 462e12e1f87f..f41d380f17ac 100644 --- a/.github/workflows/verify-links.yml +++ b/.github/workflows/verify-links.yml @@ -6,6 +6,10 @@ on: - main - release/* - hotfix/* + check_run: + types: + - completed + workflow_dispatch: permissions: contents: read @@ -13,11 +17,28 @@ permissions: jobs: verify-links: name: Verify Links + if: >- + github.event_name == 'pull_request' || + ( + github.event_name == 'check_run' && + github.event.check_run.check_suite.app.name == 'Azure Pipelines' && + ( + (github.repository == 'Azure/azure-sdk-for-net' && contains(github.event.check_run.name, 'Compliance')) || + (github.repository == 'Azure/azure-sdk-for-python' && contains(github.event.check_run.name, 'Analyze')) || + (github.repository == 'Azure/azure-sdk-for-java' && contains(github.event.check_run.name, 'Analyze')) || + (github.repository == 'Azure/azure-sdk-for-js' && contains(github.event.check_run.name, 'Analyze')) || + (github.repository == 'Azure/azure-sdk-for-cpp' && contains(github.event.check_run.name, 'GenerateReleaseArtifacts')) || + (github.repository == 'Azure/azure-sdk-for-go' && contains(github.event.check_run.name, 'Analyze')) || + (github.repository == 'Azure/azure-sdk-for-ios' && contains(github.event.check_run.name, 'Analyze')) || + (github.repository == 'Azure/azure-sdk-for-rust' && contains(github.event.check_run.name, 'Analyze')) + ) + ) runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@v4 with: + ref: ${{ github.event.pull_request.head.sha || github.event.check_run.head_sha || github.sha }} fetch-depth: 0 - name: Link verification check From 947320c6deb79ecf4623e5b7df22ce20452f7283 Mon Sep 17 00:00:00 2001 From: Mike Harder Date: Tue, 1 Sep 2026 17:32:58 -0700 Subject: [PATCH 5/5] Pin GitHub action --- .github/workflows/verify-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/verify-links.yml b/.github/workflows/verify-links.yml index f41d380f17ac..799b20930776 100644 --- a/.github/workflows/verify-links.yml +++ b/.github/workflows/verify-links.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.event.pull_request.head.sha || github.event.check_run.head_sha || github.sha }} fetch-depth: 0