From 53d1326ce181e7b8caad725393d310aee23b7f9f Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Fri, 28 Aug 2026 19:07:52 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                  | 9 +++++++++
 .github/workflows/pr_title_enforcer.yml | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 45c3b2d..acacd91 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -55,3 +55,12 @@ updates:
     commit-message:
       # Prefix all commit messages with "build: "
       prefix: "build"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/pr_title_enforcer.yml b/.github/workflows/pr_title_enforcer.yml
index f9f6c91..0da7299 100644
--- a/.github/workflows/pr_title_enforcer.yml
+++ b/.github/workflows/pr_title_enforcer.yml
@@ -15,6 +15,6 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}