Skip to content

Pin GitHub Actions to full-length commit SHAs #36510

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Microsoft Open Source Security Bot (OssSecurityBot) wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Pin GitHub Actions to full-length commit SHAs #36510

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/actions/run-publish-vr-screenshot/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ inputs:
runs:

@github-actions github-actions Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🕵🏾‍♀️ visual changes to review in the Visual Change Report

vr-tests-react-components/Menu Converged - submenuIndicator slotted content 1 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests-react-components/Menu Converged - submenuIndicator slotted content.default - RTL.submenus open.chromium.png 599 Changed
vr-tests-react-components/Positioning 2 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests-react-components/Positioning.Positioning end.updated 2 times.chromium.png 731 Changed
vr-tests-react-components/Positioning.Positioning end.chromium.png 962 Changed
vr-tests-react-components/ProgressBar converged 3 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests-react-components/ProgressBar converged.Indeterminate + thickness - Dark Mode.default.chromium.png 33 Changed
vr-tests-react-components/ProgressBar converged.Indeterminate + thickness.default.chromium.png 26 Changed
vr-tests-react-components/ProgressBar converged.Indeterminate + thickness - High Contrast.default.chromium.png 83 Changed
vr-tests-react-components/TagPicker 2 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests-react-components/TagPicker.disabled - Dark Mode.chromium.png 658 Changed
vr-tests-react-components/TagPicker.disabled - High Contrast.disabled input hover.chromium.png 1319 Changed
vr-tests-web-components/MenuList 1 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests-web-components/MenuList. - RTL.2nd selected.chromium.png 17 Changed
vr-tests/Callout 1 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests/Callout.No callout width specified.default.chromium.png 2143 Changed
vr-tests/Pivot - Overflow 1 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests/Pivot - Overflow.Tabs - RTL.chromium.png 4471 Changed
vr-tests/react-charting-LineChart 2 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests/react-charting-LineChart.Multiple - Dark Mode.default.chromium.png 181 Changed
vr-tests/react-charting-LineChart.Multiple - RTL.default.chromium.png 200 Changed
vr-tests/react-charting-MultiStackBarChart 4 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests/react-charting-MultiStackBarChart.Basic_Absolute - RTL.default.chromium.png 343 Changed
vr-tests/react-charting-MultiStackBarChart.Basic_Absolute.default.chromium.png 359 Changed
vr-tests/react-charting-MultiStackBarChart.Basic_PartToWhole - Dark Mode.default.chromium.png 363 Changed
vr-tests/react-charting-MultiStackBarChart.Basic_PartToWhole - RTL.default.chromium.png 343 Changed
vr-tests/react-charting-VerticalBarChart 1 screenshots
Image Name Diff(in Pixels) Image Type
vr-tests/react-charting-VerticalBarChart.Basic - Secondary Y Axis.default.chromium.png 3 Changed

There were 3 duplicate changes discarded. Check the build logs for more information.

using: 'composite'
steps:
- uses: nrwl/nx-set-shas@v4
- uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
with:
main-branch-name: 'master'

- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
cache: 'yarn'
node-version: '20'
Expand Down Expand Up @@ -77,7 +77,7 @@ runs:

- name: Upload VR screenshots
if: ${{ env.vrTestSkip == 'no' }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: vrscreenshot${{ inputs.fluentVersion }}
retention-days: 1
Expand Down
2 changes: 2 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ updates:
- 'patch'

# npm dependencies - weekly minor and patch updates
cooldown:
default-days: 7
- package-ecosystem: 'npm'
directory: '/'
schedule:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/azure-static-web-apps-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
runs-on: ubuntu-latest
name: Build and Deploy Job
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Build and Deploy Job
id: builddeploy
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/bundle-size-base.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
contents: 'read'

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'yarn'
node-version: '22'
Expand All @@ -48,7 +48,7 @@ jobs:
# from the value monosize-storage-git uses to read the base report.
- name: Resolve report artifact metadata
id: report
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const path = require('node:path');
Expand All @@ -58,7 +58,7 @@ jobs:
run({ core });

- name: Upload report artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: ${{ steps.report.outputs.name }}
if-no-files-found: error
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/bundle-size-comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ jobs:
permissions:
pull-requests: write
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
sparse-checkout: |
.github

- name: Download artifact
uses: actions/download-artifact@v7
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: monosize-report
path: ./results
Expand All @@ -27,7 +27,7 @@ jobs:

- name: Load PR number
id: pr_number
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
result-encoding: string
script: |
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/bundle-size.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
actions: 'read'

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

Expand All @@ -32,7 +32,7 @@ jobs:
with:
main-branch-name: 'master'

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'yarn'
node-version: '22'
Expand Down Expand Up @@ -60,7 +60,7 @@ jobs:
if: ${{ github.event.pull_request.base.ref == 'master' }}
run: echo ${{ github.event.number }} > pr.txt

- uses: actions/upload-artifact@v6
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
if: ${{ github.event.pull_request.base.ref == 'master' }}
with:
name: monosize-report
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/check-packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ jobs:
runs-on: ubuntu-latest
if: ${{ github.repository_owner == 'microsoft' }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: '22'
cache: 'yarn'
Expand Down Expand Up @@ -43,15 +43,15 @@ jobs:
runs-on: ubuntu-latest
if: ${{ github.repository_owner == 'microsoft' }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: 22.x

- uses: actions/github-script@v8
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const syncpackVersion = require('./package.json').devDependencies.syncpack;
Expand All @@ -70,15 +70,15 @@ jobs:
runs-on: ubuntu-latest
if: ${{ github.repository_owner == 'microsoft' }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: 22.x

- uses: actions/github-script@v8
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const beachballVersion = require('./package.json').devDependencies.beachball;
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/check-tooling.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,11 @@ jobs:
os: [ubuntu-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: '22'

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/copilot-setup-steps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ jobs:
# If you do not check out your code, Copilot will do this for you.
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

- name: Set up Node.js
uses: actions/setup-node@v6
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'yarn'
node-version: '22'
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/docsite-publish-ghpages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
artifact_id: ${{ steps.artifact_upload.outputs.artifact_id }}

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

Expand All @@ -23,7 +23,7 @@ jobs:
with:
main-branch-name: 'master'

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: '22'
cache: 'yarn'
Expand Down Expand Up @@ -59,7 +59,7 @@ jobs:
- name: Upload Pages Artifact
if: steps.affected_storybooks_count.outputs.value > 0
id: artifact_upload
uses: actions/upload-pages-artifact@v4
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
with:
path: _pages

Expand All @@ -80,4 +80,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
4 changes: 2 additions & 2 deletions .github/workflows/issues.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ jobs:
issues: write

steps:
- uses: actions/checkout@v6
- uses: actions/github-script@v8
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const config = require('./.github/triage-bot.config.json');
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pr-housekeeping.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
if: ${{ github.repository_owner == 'microsoft' }}
runs-on: ubuntu-latest
steps:
- uses: actions/labeler@v6
- uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
with:
repo-token: '${{ secrets.GITHUB_TOKEN }}'
sync-labels: true
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/pr-vrt-comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
contents: read
actions: read
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
sparse-checkout: |
.github
Expand All @@ -30,15 +30,15 @@ jobs:
# - see @{link file://./../scripts/prepare-vr-screenshots-for-upload.js#45}
# - see @{link file://./pr-vrt.yml#56}

- uses: actions/download-artifact@v7
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: vrscreenshot
path: ./screenshots
run-id: ${{ github.event.workflow_run.id }}
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Check if visual regression should be run (affected projects)
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
id: should_run_vrt
with:
script: |
Expand All @@ -56,7 +56,7 @@ jobs:
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- uses: actions/download-artifact@v7
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
if: ${{ steps.should_run_vrt.outputs.result == 'true' }}
with:
name: pr-number
Expand All @@ -66,7 +66,7 @@ jobs:

- name: Run VR Approval CLI
if: ${{ steps.should_run_vrt.outputs.result == 'true' }}
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
# this is explicity needed as github token is not available in CLI context
GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/pr-vrt.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
name: Generate screenshots
timeout-minutes: 60
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0

Expand All @@ -35,7 +35,7 @@ jobs:
with:
main-branch-name: 'master'

- uses: actions/setup-node@v6
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'yarn'
node-version: '22'
Expand All @@ -47,7 +47,7 @@ jobs:
run: yarn nx affected -t test-vr --nxBail

- name: Prepare VR screenshots for upload
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
id: screenshots_root
with:
script: |
Expand All @@ -60,7 +60,7 @@ jobs:
result-encoding: string

- name: Upload VR screenshots
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: vrscreenshot
retention-days: 1
Expand All @@ -69,7 +69,7 @@ jobs:
- name: Save PR number
run: echo ${{ github.event.number }} > pr.txt

- uses: actions/upload-artifact@v6
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: pr-number
retention-days: 1
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/pr-website-deploy-comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,27 +25,27 @@ jobs:
id-token: write

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
sparse-checkout: |
.github

- uses: actions/download-artifact@v7
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: pr-website-artifacts
path: ./website
run-id: ${{ github.event.workflow_run.id }}
github-token: ${{ secrets.GITHUB_TOKEN }}

- uses: actions/download-artifact@v7
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with:
name: pr-number
path: ./results
run-id: ${{ github.event.workflow_run.id }}
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Load PR number
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
id: pr_number
with:
script: |
Expand Down Expand Up @@ -88,7 +88,7 @@ jobs:
pull-requests: write
statuses: write
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: 'Comment on PR'
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
Expand All @@ -99,7 +99,7 @@ jobs:
Pull request demo site: [URL](${{needs.deploy.outputs.website_url}})

- name: Update PR deploy site GitHub status
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const run = require('./.github/scripts/deploy-pr-site-status');
Expand Down
Loading
Loading