Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/common-server-ci.yml

@@ -29,16 +29,16 @@ jobs:
       APP_INSIGHTS_KEY: ${{ secrets.AML_APP_INSIGHTS_KEY }}
     steps:
       - name: Clone branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       # Specify the python version
       - name: Set Python version
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: ${{matrix.python_version}}
 
       - name: Log in to Azure
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -64,7 +64,7 @@ jobs:
             coverage xml --ignore-errors
 
       - name: Code Coverage Summary
-        uses: orgoro/coverage@v3
+        uses: orgoro/coverage@d77626a5fa35d39123e86d6c62907fabe2491496 # v3
         with:
           coverageFile: /home/runner/work/azureml-inference-server/azureml-inference-server/coverage.xml
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -75,7 +75,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: Clone branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Install flake8
         run: pip install flake8
@@ -88,7 +88,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: Clone branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Install black
         run: pip install black

.github/workflows/inference-http-server-E2E-ci.yml

@@ -27,11 +27,11 @@ jobs:
 
     steps:
       - name: Clone branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       # Specify the python version
       - name: Set Python version
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: ${{matrix.python_version}}
 
@@ -49,7 +49,7 @@ jobs:
         shell: bash
 
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
         if: runner.os == 'Linux' && always()
         with:
           files: |
@@ -58,7 +58,7 @@ jobs:
           check_name: ${{matrix.pool_vmImage}} Python ${{matrix.python_version}}
 
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action/composite@v2
+        uses: EnricoMi/publish-unit-test-result-action/composite@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
         if: runner.os == 'Windows' && always()
         with:
           files: |

.github/workflows/publish.yml

@@ -10,10 +10,10 @@ jobs:
     environment: Server-CI
     steps:
     - name: Clone the repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Setup python version
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
       with:
         python-version: '3.9'