Roger Barreto 01a3c5be8a ci: pin third-party GitHub Actions to commit SHAs (#5972) ...

Replaces every floating tag in our workflow and composite action files
with an immutable 40-character commit SHA, keeping the original `# vX`
comment so Dependabot can still propose version bumps. 186 occurrences
across 25 workflows and 2 composite actions.

Also widens the github-actions Dependabot entry to use the plural
`directories` key with `/.github/actions/*` so composite actions under
`.github/actions/<name>/action.yml` are kept up to date. Previously
Dependabot only scanned `.github/workflows` and the repo-root
`action.yml`, leaving our `python-setup` and `sample-validation-setup`
composite actions unmaintained.

01a3c5be8a · 2026-05-20 22:10:32 +00:00

History

..

azure-functions-integration-setup

.NET: Durable Agent samples and automated validation for non-Azure Functions (#3042)

2026-01-20 22:45:10 +00:00

python-setup

ci: pin third-party GitHub Actions to commit SHAs (#5972)

2026-05-20 22:10:32 +00:00

sample-validation-setup

ci: pin third-party GitHub Actions to commit SHAs (#5972)

2026-05-20 22:10:32 +00:00

setup-local-mcp-server

Python: [BREAKING] Python: Provider-leading client design & OpenAI package extraction (#4818)

2026-03-25 09:56:29 +00:00