From fbb7d536f02beb6ae758293e7645d88968895fb8 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Fri, 28 Aug 2026 22:48:47 -0400
Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml   | 4 +++-
 .github/workflows/ci.yml | 8 ++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 82c6b61f..69e61760 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -31,4 +33,4 @@ updates:
     groups:
       eslint:
         patterns:
-          - "*eslint*"
+          - "*eslint*"
\ No newline at end of file
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index deed9762..46fbcae1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,13 +13,13 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: "6"
 
@@ -41,7 +41,7 @@ jobs:
 
       - if: runner.os == 'Linux'
         name: Upload tarball
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: "azure-oad-*.tgz"
           archive: false

From 9aca605db7ec8125b429df29d35aaa1473ebab7e Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Sat, 29 Aug 2026 14:56:00 -0700
Subject: [PATCH 2/2] Fix formatting in dependabot.yml

---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 69e61760..9ed49c5b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,4 +33,4 @@ updates:
     groups:
       eslint:
         patterns:
-          - "*eslint*"
\ No newline at end of file
+          - "*eslint*"