Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
     directory: "/.github/workflows/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "docker"
     directory: "/.devcontainer/"
     schedule:
@@ -47,4 +49,4 @@ updates:
 #  - package-ecosystem: "pre-commit"
 #    directory: "/"
 #    schedule:
-#      interval: "daily"
+#      interval: "daily"

.github/workflows/codeql.yml

@@ -46,11 +46,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,7 +64,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -77,6 +77,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/devcontainer.yml

@@ -41,7 +41,7 @@ jobs:
       BUILDKIT_INLINE_CACHE: 1
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Get commit messages
       id: get-commit-messages
@@ -210,7 +210,7 @@ jobs:
 
     - name: Upload coverage report as build artifact
       if: always() # ensures it runs even if tests fail
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: coverage-report
         path: coverage.xml
@@ -235,7 +235,7 @@ jobs:
         # Make sure we can publish the coverage report.
         rm -f doc/build/html/htmlcov/.gitignore
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: docs
         path: doc/build/html
@@ -266,7 +266,7 @@ jobs:
 
     - name: Container Registry Login
       if: (github.repository == 'microsoft/mlos') && (github.ref == 'refs/heads/main' || github.ref_type == 'tag')
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
       with:
         # This is the URL of the container registry, which is configured in Github
         # Settings and currently corresponds to the mlos-core ACR.
@@ -311,9 +311,9 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: docs
         path: doc/build/html
@@ -332,7 +332,7 @@ jobs:
         fi
 
     - name: Deploy to GitHub pages
-      uses: JamesIves/github-pages-deploy-action@v4
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0
       with:
         branch: gh-pages
         folder: doc/build/html

.github/workflows/linux.yml

@@ -51,9 +51,9 @@ jobs:
       MAKEFLAGS: -Oline
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-    - uses: conda-incubator/setup-miniconda@v3
+    - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
 
     - name: Set cache timestamp variables
       id: set_cache_vars
@@ -78,7 +78,7 @@ jobs:
     - name: Restore cached conda packages
       id: restore-conda-cache
       if: ${{ github.event_name != 'schedule' }}
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         #path: ${{ env.CONDA_DIR }}/envs/${{ env.CONDA_ENV_NAME }}
         path: ${{ env.CONDA_DIR }}/pkgs
@@ -90,7 +90,7 @@ jobs:
     - name: Restore cached pip packages
       id: restore-pip-cache
       if: ${{ github.event_name != 'schedule' }}
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ env.PIP_CACHE_DIR }}
         key: conda-${{ runner.os }}-${{ env.CONDA_ENV_NAME }}-${{ hashFiles('conda-envs/${{ env.CONDA_ENV_NAME }}.yml') }}-${{ hashFiles('mlos_*/pyproject.toml') }}-${{ hashFiles('mlos_*/setup.py') }}-${{ env.cache_cur_date }}-${{ env.cache_cur_hour }}
@@ -101,7 +101,7 @@ jobs:
     - name: Restore cached pre-commit hooks
       id: restore-pre-commit-cache
       if: ${{ github.event_name != 'schedule' }}
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ~/.cache/pre-commit
         key: pre-commit-${{ runner.os }}-${{ env.CONDA_ENV_NAME }}-${{ hashFiles('conda-envs/${{ env.CONDA_ENV_NAME }}.yml') }}-${{ hashFiles('.pre-commit-config.yaml') }}-${{ env.cache_cur_date }}-${{ env.cache_cur_hour }}

.github/workflows/macos.yml

@@ -56,9 +56,9 @@ jobs:
       MAKEFLAGS: -Oline
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-    - uses: conda-incubator/setup-miniconda@v3
+    - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
 
     - name: Set cache timestamp variables
       id: set_cache_vars
@@ -83,7 +83,7 @@ jobs:
     - name: Restore cached conda packages
       id: restore-conda-cache
       if: ${{ github.event_name != 'schedule' }}
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         #path: ${{ env.CONDA_DIR }}/envs/${{ env.CONDA_ENV_NAME }}
         path: ${{ env.CONDA_DIR }}/pkgs
@@ -95,7 +95,7 @@ jobs:
     - name: Restore cached pip packages
       id: restore-pip-cache
       if: ${{ github.event_name != 'schedule' }}
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ env.PIP_CACHE_DIR }}
         key: conda-${{ runner.os }}-${{ env.CONDA_ENV_NAME }}-${{ hashFiles('conda-envs/${{ env.CONDA_ENV_NAME }}.yml') }}-${{ hashFiles('mlos_*/pyproject.toml') }}-${{ hashFiles('mlos_*/setup.py') }}-${{ env.cache_cur_date }}-${{ env.cache_cur_hour }}
@@ -177,7 +177,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Install docker
       timeout-minutes: 15

.github/workflows/markdown-link-check.yml

@@ -25,8 +25,8 @@ jobs:
       contents: read
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v4
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+    - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
       with:
         use-quiet-mode: yes
         use-verbose-mode: yes

.github/workflows/windows.yml

@@ -40,9 +40,9 @@ jobs:
       cache_prev_hour: unset
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-    - uses: conda-incubator/setup-miniconda@v3
+    - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
 
     - name: Set cache timestamp variables
       id: set_cache_vars
@@ -67,7 +67,7 @@ jobs:
     - name: Restore cached conda environment
       id: restore-conda-cache
       if: github.event_name != 'schedule'
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ env.CONDA }}/envs/mlos
         key: conda-${{ runner.os }}-${{ env.CONDA_ENV_NAME }}-${{ hashFiles('conda-envs/${{ env.CONDA_ENV_YML }}') }}-${{ hashFiles('mlos_*/pyproject.toml') }}-${{ hashFiles('mlos_*/setup.py') }}-${{ env.cache_cur_date }}-${{ env.cache_cur_hour }}
@@ -158,7 +158,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Check docker
       run: |