From e4c0b672a76e71bd9a5dc2256bf1943d51c1e6fc Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Sun, 23 Aug 2026 19:41:15 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml            | 11 +++++++++++
 .github/workflows/deploy-site.yml | 10 +++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml
index e08f487..b5d11bc 100644
--- a/.github/workflows/deploy-site.yml
+++ b/.github/workflows/deploy-site.yml
@@ -27,10 +27,10 @@ jobs:
           working-directory: ./src/website
       steps:
         - name: Checkout
-          uses: actions/checkout@v4
+          uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         # 👇 Build steps
         - name: Set up Node.js
-          uses: actions/setup-node@v3
+          uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
           with:
             node-version: 16.x
             cache: yarn
@@ -41,12 +41,12 @@ jobs:
           run: yarn build
         # 👆 Build steps
         - name: Setup Pages
-          uses: actions/configure-pages@v3
+          uses: actions/configure-pages@b8130d9ab958b325bbde9786d62f2c97a9885a0e # v3.0.7
         - name: Upload artifact
-          uses: actions/upload-pages-artifact@v3
+          uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
           with:
             # 👇 Specify build output path
             path: src/website/build
         - name: Deploy to GitHub Pages
           id: deployment
-          uses: actions/deploy-pages@v4
+          uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5