From aea0cc2ec634ea84b74413f852cff41c1c2a4ecd Mon Sep 17 00:00:00 2001 From: Genevieve Warren <24882762+gewarren@users.noreply.github.com> Date: Tue, 15 Sep 2026 09:50:51 -0700 Subject: [PATCH 1/3] update dependabot config and use SHAs/tags --- .github/dependabot.yml | 7 +++++-- .github/workflows/build-docs-verifier.yml | 8 ++++---- .github/workflows/codeql-analysis.yml | 10 +++++----- .github/workflows/dotnet-build-validation.yml | 12 ++++++------ .github/workflows/node-build-validation.yml | 4 ++-- .github/workflows/quest-bulk.yml | 8 ++++---- .github/workflows/quest.yml | 8 ++++---- 7 files changed, 30 insertions(+), 27 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 592662bb..3366ecc6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,10 +3,13 @@ updates: # GitHub Actions - package-ecosystem: "github-actions" directory: "/" + groups: + github-actions: + patterns: ["*"] schedule: interval: "weekly" - day: "wednesday" - open-pull-requests-limit: 10 + cooldown: + default-days: 7 # NuGet packages - package-ecosystem: "nuget" directory: "/" diff --git a/.github/workflows/build-docs-verifier.yml b/.github/workflows/build-docs-verifier.yml index be32f1f7..a8c0da28 100644 --- a/.github/workflows/build-docs-verifier.yml +++ b/.github/workflows/build-docs-verifier.yml @@ -10,15 +10,15 @@ jobs: configuration: [debug, release] runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@v7 with: fetch-depth: 0 - name: Setup .NET - uses: actions/setup-dotnet@main + uses: actions/setup-dotnet@v6 with: dotnet-version: '10.0.x' - name: Try get cached dependencies - uses: actions/cache@main + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 with: path: ${{ github.workspace }}/.nuget/packages key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }} @@ -31,7 +31,7 @@ jobs: - name: Test run: dotnet test actions/docs-verifier - name: Upload Results - uses: actions/upload-artifact@main + uses: actions/upload-artifact@v7 with: name: ${{ matrix.os }}_${{ matrix.configuration }} path: | diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 8d42cbba..f1c559e3 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -26,20 +26,20 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@main + uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@main + uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: languages: ${{ matrix.language }} - name: Build JavaScript if: ${{ matrix.language == 'javascript' }} - uses: github/codeql-action/autobuild@main + uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 - name: Setup .NET if: ${{ matrix.language == 'csharp' }} - uses: actions/setup-dotnet@main + uses: actions/setup-dotnet@v6 with: dotnet-version: 10.0.x @@ -53,4 +53,4 @@ jobs: dotnet build --configuration Release --no-restore - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@main + uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 diff --git a/.github/workflows/dotnet-build-validation.yml b/.github/workflows/dotnet-build-validation.yml index af0088a1..08f32eac 100644 --- a/.github/workflows/dotnet-build-validation.yml +++ b/.github/workflows/dotnet-build-validation.yml @@ -23,7 +23,7 @@ jobs: name: build runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@v7 - name: 'Print manual run reason' if: ${{ github.event_name == 'workflow_dispatch' }} @@ -33,14 +33,14 @@ jobs: REASON: ${{ github.event.inputs.reason }} - name: Setup .NET 10.0 - uses: actions/setup-dotnet@main + uses: actions/setup-dotnet@v6 with: dotnet-version: 10.0.x - name: Restore dependencies for .NET docs tools run: | dotnet restore docs-tools.sln - + - name: Build .NET docs tools run: | dotnet build docs-tools.sln --configuration Release --no-restore @@ -51,10 +51,10 @@ jobs: needs: build steps: - - uses: actions/checkout@main - + - uses: actions/checkout@v7 + - name: Setup .NET 10.0 - uses: actions/setup-dotnet@main + uses: actions/setup-dotnet@v6 with: dotnet-version: 10.0.x diff --git a/.github/workflows/node-build-validation.yml b/.github/workflows/node-build-validation.yml index 97943130..c21b173b 100644 --- a/.github/workflows/node-build-validation.yml +++ b/.github/workflows/node-build-validation.yml @@ -17,9 +17,9 @@ jobs: name: build runs-on: ubuntu-latest steps: - - uses: actions/checkout@main + - uses: actions/checkout@v7 - name: Use Node.js 18 - uses: actions/setup-node@main + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 18 cache: 'npm' diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml index dd2f52ff..01bab377 100644 --- a/.github/workflows/quest-bulk.yml +++ b/.github/workflows/quest-bulk.yml @@ -23,7 +23,7 @@ jobs: id-token: write pull-requests: write if: ${{ github.repository_owner == 'dotnet' }} - + steps: - name: "Print manual bulk import run reason" if: ${{ github.event_name == 'workflow_dispatch' }} @@ -34,7 +34,7 @@ jobs: - name: Azure OpenID Connect id: azure-oidc-auth - uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow@main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -42,7 +42,7 @@ jobs: - name: Azure DevOps OpenID Connect id: azure-devops-oidc-auth - uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow@main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -50,7 +50,7 @@ jobs: - name: bulk-sequester id: bulk-sequester - uses: dotnet/docs-tools/actions/sequester@main + uses: $/.github/actions/sequester@main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml index 5e758c34..8bead8fb 100644 --- a/.github/workflows/quest.yml +++ b/.github/workflows/quest.yml @@ -40,7 +40,7 @@ jobs: - name: Azure OpenID Connect id: azure-oidc-auth - uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow@main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -48,7 +48,7 @@ jobs: - name: Azure DevOps OpenID Connect for manual test runs id: azure-devops-oidc-auth - uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow@main with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -59,7 +59,7 @@ jobs: - name: manual-sequester if: ${{ github.event_name == 'workflow_dispatch' }} id: manual-sequester - uses: dotnet/docs-tools/actions/sequester@main + uses: $/.github/actions/sequester@main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} @@ -75,7 +75,7 @@ jobs: - name: auto-sequester if: ${{ github.event_name != 'workflow_dispatch' }} id: auto-sequester - uses: ./actions/sequester + uses: $/.github/actions/sequester@main env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} From 0eba1cb860705923834832b7fb010251b373d6cd Mon Sep 17 00:00:00 2001 From: Genevieve Warren <24882762+gewarren@users.noreply.github.com> Date: Tue, 15 Sep 2026 10:37:40 -0700 Subject: [PATCH 2/3] remove tag for same repo --- .github/workflows/quest-bulk.yml | 6 +++--- .github/workflows/quest.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml index 01bab377..24e2f193 100644 --- a/.github/workflows/quest-bulk.yml +++ b/.github/workflows/quest-bulk.yml @@ -34,7 +34,7 @@ jobs: - name: Azure OpenID Connect id: azure-oidc-auth - uses: $/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -42,7 +42,7 @@ jobs: - name: Azure DevOps OpenID Connect id: azure-devops-oidc-auth - uses: $/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -50,7 +50,7 @@ jobs: - name: bulk-sequester id: bulk-sequester - uses: $/.github/actions/sequester@main + uses: $/.github/actions/sequester env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml index 8bead8fb..e4fd4a8f 100644 --- a/.github/workflows/quest.yml +++ b/.github/workflows/quest.yml @@ -40,7 +40,7 @@ jobs: - name: Azure OpenID Connect id: azure-oidc-auth - uses: $/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -48,7 +48,7 @@ jobs: - name: Azure DevOps OpenID Connect for manual test runs id: azure-devops-oidc-auth - uses: $/.github/actions/oidc-auth-flow@main + uses: $/.github/actions/oidc-auth-flow with: client-id: ${{ secrets.CLIENT_ID }} tenant-id: ${{ secrets.TENANT_ID }} @@ -59,7 +59,7 @@ jobs: - name: manual-sequester if: ${{ github.event_name == 'workflow_dispatch' }} id: manual-sequester - uses: $/.github/actions/sequester@main + uses: $/.github/actions/sequester env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} @@ -75,7 +75,7 @@ jobs: - name: auto-sequester if: ${{ github.event_name != 'workflow_dispatch' }} id: auto-sequester - uses: $/.github/actions/sequester@main + uses: $/.github/actions/sequester env: ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }} ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }} From ed236e13373e3df54017064c754253e21f1ba3d5 Mon Sep 17 00:00:00 2001 From: Genevieve Warren <24882762+gewarren@users.noreply.github.com> Date: Tue, 15 Sep 2026 11:07:54 -0700 Subject: [PATCH 3/3] Update upload-artifact action version Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/build-docs-verifier.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-docs-verifier.yml b/.github/workflows/build-docs-verifier.yml index a8c0da28..9675e591 100644 --- a/.github/workflows/build-docs-verifier.yml +++ b/.github/workflows/build-docs-verifier.yml @@ -31,7 +31,7 @@ jobs: - name: Test run: dotnet test actions/docs-verifier - name: Upload Results - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: ${{ matrix.os }}_${{ matrix.configuration }} path: |