From a4af0a1c506e63fde5cb2360fce6157309e3a80f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 14:43:34 +0000 Subject: [PATCH 1/2] Bump guibranco/github-infisical-secrets-check-action Bumps the github-actions group with 1 update: [guibranco/github-infisical-secrets-check-action](https://github.com/guibranco/github-infisical-secrets-check-action). Updates `guibranco/github-infisical-secrets-check-action` from 5.2.2 to 5.2.4 - [Release notes](https://github.com/guibranco/github-infisical-secrets-check-action/releases) - [Commits](https://github.com/guibranco/github-infisical-secrets-check-action/compare/v5.2.2...v5.2.4) --- updated-dependencies: - dependency-name: guibranco/github-infisical-secrets-check-action dependency-version: 5.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/infisical-secrets-check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/infisical-secrets-check.yml b/.github/workflows/infisical-secrets-check.yml index 151446cd..a72e57fe 100644 --- a/.github/workflows/infisical-secrets-check.yml +++ b/.github/workflows/infisical-secrets-check.yml @@ -23,4 +23,4 @@ jobs: fetch-depth: 0 - name: Infisical secrets check - uses: guibranco/github-infisical-secrets-check-action@v5.2.2 + uses: guibranco/github-infisical-secrets-check-action@v5.2.4 From f50f155a40c0e4100b9ab6074c40bd47880b5803 Mon Sep 17 00:00:00 2001 From: "gstraccini[bot]" <150967461+gstraccini[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 02:20:00 +0000 Subject: [PATCH 2/2] chore: pin GitHub Actions to immutable commit SHA --- .github/workflows/build.yml | 10 +++++----- .github/workflows/codacy.yml | 4 ++-- .github/workflows/codeql.yml | 10 +++++----- .github/workflows/contributors-readme.yml | 4 ++-- .github/workflows/infersharp.yml | 6 +++--- .github/workflows/infisical-secrets-check.yml | 4 ++-- .github/workflows/linter.yml | 2 +- .github/workflows/publish-docs.yml | 4 ++-- .github/workflows/release.yml | 16 ++++++++-------- .github/workflows/size-label.yml | 2 +- .github/workflows/sonarcloud-pixeebot.yml | 2 +- 11 files changed, 32 insertions(+), 32 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 63426286..daaa046b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -33,19 +33,19 @@ jobs: steps: - name: 📥 Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 - name: ☕ Setup Java runtime - uses: actions/setup-java@v5 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5 with: java-version: 17 distribution: temurin - name: 🧰 Setup .NET SDK - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: '10.0.x' @@ -56,7 +56,7 @@ jobs: run: curl https://deepsource.io/cli | sh - name: 💾 Cache NuGet packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/global.json', '**/packages.lock.json') }} @@ -95,7 +95,7 @@ jobs: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: ☂️ Upload coverage to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 with: token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml index 1641c35b..237b5beb 100644 --- a/.github/workflows/codacy.yml +++ b/.github/workflows/codacy.yml @@ -35,11 +35,11 @@ jobs: steps: # 1️⃣ Checkout the repository - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 # 2️⃣ Run Codacy Analysis CLI, produce results.sarif - name: Run Codacy Analysis CLI - uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 + uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # 562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 with: project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} verbose: true diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a759a34e..08d54fcc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,22 +24,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Set up .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: '9.x' - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: category: "security" diff --git a/.github/workflows/contributors-readme.yml b/.github/workflows/contributors-readme.yml index 34044181..52bcd2c7 100644 --- a/.github/workflows/contributors-readme.yml +++ b/.github/workflows/contributors-readme.yml @@ -18,14 +18,14 @@ jobs: steps: - name: Contribute List in README.md - uses: akhilmhdh/contributors-readme-action@v2.3.11 + uses: akhilmhdh/contributors-readme-action@83ea0b4f1ac928fbfe88b9e8460a932a528eb79f # v2.3.11 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: readme_path: README.md - name: Contribute List in README.md - uses: akhilmhdh/contributors-readme-action@v2.3.11 + uses: akhilmhdh/contributors-readme-action@83ea0b4f1ac928fbfe88b9e8460a932a528eb79f # v2.3.11 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/infersharp.yml b/.github/workflows/infersharp.yml index bac6fc60..37fb6dff 100644 --- a/.github/workflows/infersharp.yml +++ b/.github/workflows/infersharp.yml @@ -14,14 +14,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Run InferSharp - uses: microsoft/infersharpaction@v1.5 + uses: microsoft/infersharpaction@b749060de518f410f92c87d37d2366e5e9d7c5fc # v1.5 - name: Upload SARIF results if: success() && steps.infersharp.outputs.sarif-report - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: sarif_file: ${{ steps.infersharp.outputs.sarif-report }} continue-on-error: true diff --git a/.github/workflows/infisical-secrets-check.yml b/.github/workflows/infisical-secrets-check.yml index a72e57fe..62b4dece 100644 --- a/.github/workflows/infisical-secrets-check.yml +++ b/.github/workflows/infisical-secrets-check.yml @@ -18,9 +18,9 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 - name: Infisical secrets check - uses: guibranco/github-infisical-secrets-check-action@v5.2.4 + uses: guibranco/github-infisical-secrets-check-action@4a08adfc5cfb962c807067da863f3704885e731a # v5.2.4 diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 853625de..0ea5e7b8 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -12,4 +12,4 @@ jobs: pull-requests: write steps: - name: CSharpier Linter - uses: guibranco/github-csharpier-linter-action@v1.0.25 + uses: guibranco/github-csharpier-linter-action@f62644adf5dcf23afb21f3190a6f6f488233f2a6 # v1.0.25 diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml index 3ac55e0b..3dffa379 100644 --- a/.github/workflows/publish-docs.yml +++ b/.github/workflows/publish-docs.yml @@ -11,11 +11,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout main - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 - name: Deploy docs - uses: mhausenblas/mkdocs-deploy-gh-pages@1.26 + uses: mhausenblas/mkdocs-deploy-gh-pages@d77dd03172e96abbcdb081d8c948224762033653 # 1.26 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 14570328..57a4249b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,32 +45,32 @@ jobs: steps: # ── Checkout ───────────────────────────────────────────────────────────── - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} # ── Toolchain ──────────────────────────────────────────────────────────── - name: Setup .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: "10.0.x" - name: Setup Java 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5 with: distribution: temurin java-version: "21" # ── GitVersion ─────────────────────────────────────────────────────────── - name: Install GitVersion - uses: gittools/actions/gitversion/setup@v4 + uses: gittools/actions/gitversion/setup@7417b1089e2c7de93510f1901d656ddf60bb024f # v4 with: versionSpec: "6.x" - name: Determine version id: gitversion - uses: gittools/actions/gitversion/execute@v4 + uses: gittools/actions/gitversion/execute@7417b1089e2c7de93510f1901d656ddf60bb024f # v4 - name: Patch .props files with computed version run: | @@ -137,7 +137,7 @@ jobs: done - name: Publish test results - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: always() with: name: test-results-${{ github.run_id }} @@ -145,7 +145,7 @@ jobs: # ── Coverage reporting ──────────────────────────────────────────────────── - name: Report coverage → Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: Tests/${{ steps.solution.outputs.name }}.Tests/coverage.net9.0.opencover.xml @@ -262,7 +262,7 @@ jobs: # ── Create GitHub Release ───────────────────────────────────────────────── - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 with: tag_name: v${{ steps.gitversion.outputs.semVer }} name: Release of ${{ steps.solution.outputs.name }} – v${{ steps.gitversion.outputs.semVer }} diff --git a/.github/workflows/size-label.yml b/.github/workflows/size-label.yml index 2cec5fce..8859e303 100644 --- a/.github/workflows/size-label.yml +++ b/.github/workflows/size-label.yml @@ -19,6 +19,6 @@ jobs: ) || ( github.event_name == 'workflow_dispatch' ) - uses: "pascalgn/size-label-action@v0.5.7" + uses: "pascalgn/size-label-action@56b489b027932ec0cf60438a1a5f1a19c8fc71ff" # v0.5.7 env: GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/sonarcloud-pixeebot.yml b/.github/workflows/sonarcloud-pixeebot.yml index 5651543b..3dcd11b8 100644 --- a/.github/workflows/sonarcloud-pixeebot.yml +++ b/.github/workflows/sonarcloud-pixeebot.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event.check_run.name == 'SonarCloud Code Analysis' }} steps: - - uses: pixee/upload-tool-results-action@v2 + - uses: pixee/upload-tool-results-action@9394b64cae9cd00d86095b2b8dc6423d45507434 # v2 with: tool: sonar sonar-token: ${{ secrets.SONAR_TOKEN }}