pinned actions sha

Author: KittyChiu

.github/dependabot.yml

@@ -14,6 +14,8 @@ updates:
     schedule:
       # Monthly scheduled updates to balance freshness with maintenance effort; security updates can still be raised separately
       interval: "monthly"
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "chore(deps)"
     reviewers:
@@ -35,6 +37,8 @@ updates:
     schedule:
       # Monthly scheduled updates to balance freshness with maintenance effort; security updates can still be raised separately
       interval: "monthly"
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "chore(deps)"
     versioning-strategy: increase-if-necessary

.github/workflows/deploy-merged-pr.yml

@@ -107,7 +107,7 @@ jobs:
       # OSS App
       - name: Generate GitHub App Token
         id: pr_app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           app-id: ${{ vars.WELLARCHITECTED_OSS_APP_ID }}
           private-key: ${{ secrets.WELLARCHITECTED_OSS_APP_PRIVATE_KEY }}
@@ -140,7 +140,7 @@ jobs:
       # OSS App
       - name: Generate GitHub App Token
         id: dispatch_app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
           app-id: ${{ vars.WELLARCHITECTED_OSS_APP_ID }}
           private-key: ${{ secrets.WELLARCHITECTED_OSS_APP_PRIVATE_KEY }}

.github/workflows/pr-check.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: 'npm'
@@ -60,13 +60,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v5
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
         with:
           config-file: >-
             ./.github/dependency-review-config.yml
@@ -77,13 +77,13 @@ jobs:
           sudo dpkg -i ${{ runner.temp }}/hugo.deb
           hugo version
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: 'npm'
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('package-lock.json') }}
@@ -144,7 +144,7 @@ jobs:
         run: |
           npm run test:functional
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: playwright-report