From ae24cd11b024ea2f4bf8b9f3fedbdaf1ea56b295 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Fri, 14 Aug 2026 16:16:09 -0400 Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/changelog.yml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2c01508c..568164b5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -98,3 +98,5 @@ updates: applies-to: security-updates patterns: - "*" + cooldown: + default-days: 7 diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index c45c16fe..b1f5570e 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -10,6 +10,6 @@ jobs: name: Check Changelog Action runs-on: ubuntu-latest steps: - - uses: tarides/changelog-check-action@v2 + - uses: tarides/changelog-check-action@47122075af50b17dbf68f7d059c88c99f082ac43 # v2 with: changelog: Changelog.md \ No newline at end of file