Repository navigation

Pin GitHub Actions to commit SHAs #1770

Closed

Assignees

Labels

opened

on Aug 19, 2026

For supply-chain security, we should pin the GitHub Actions referenced in the workflows to their commit SHAs. Dependabot can be used to automatically update these commit SHAs with a specified cooldown period.

See example at microsoft/dotnet-framework-docker#1317

github-project-automation
added this to .NET Source Buildon Aug 19, 2026
github-project-automation
moved this to Backlog in .NET Source Buildon Aug 19, 2026
github-actions
added
untriagedNeeds to be triaged
on Aug 19, 2026
mthalman
added
area-buildRelated to builds (developer, CI and PR validation)
and removed
untriagedNeeds to be triaged
on Aug 20, 2026
mthalman
assigned
Copilot
and
mthalman
on Aug 20, 2026
Copilot
linked a pull request that will close this issuePin workflow actions to immutable SHAs and add Dependabot SHA update policy #1772 on Aug 20, 2026
mthalman
closed this as completedin #1772 on Aug 20, 2026
github-project-automation
moved this from Backlog to Done in .NET Source Buildon Aug 20, 2026

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Labels

Type

No type

Projects

.NET Source Build
Status
Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests