From 9c093dc8040964515aaa7da38584040454b05053 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 12 Aug 2026 14:36:21 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml               |  2 ++
 .github/workflows/publish_docker.yml |  8 ++++----
 .github/workflows/test.yml           | 12 ++++++------
 .github/workflows/test_cli.yml       |  4 ++--
 .github/workflows/test_docker.yml    |  2 +-
 .github/workflows/verify_api.yml     |  2 +-
 6 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a964f2f3c..cffb917d3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,3 +25,5 @@ updates:
       actions:
         patterns:
           - "*" 
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml
index d0a35182b..bf1fd3338 100644
--- a/.github/workflows/publish_docker.yml
+++ b/.github/workflows/publish_docker.yml
@@ -13,9 +13,9 @@ jobs:
     environment: Docker
     if: github.repository == 'microsoft/playwright-java'
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Azure login
-      uses: azure/login@v3
+      uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
       with:
         client-id: ${{ secrets.AZURE_DOCKER_CLIENT_ID }}
         tenant-id: ${{ secrets.AZURE_DOCKER_TENANT_ID }}
@@ -23,8 +23,8 @@ jobs:
     - name: Login to ACR via OIDC
       run: az acr login --name playwright
     - name: Set up Docker QEMU for arm64 docker builds
-      uses: docker/setup-qemu-action@v4
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       with:
         platforms: arm64
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - run: ./utils/docker/publish_docker.sh stable
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2b6878985..b15c361d0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,9 +28,9 @@ jobs:
             browser: webkit
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up JDK 1.8
-      uses: actions/setup-java@v5.6.0
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
       with:
         distribution: zulu
         java-version: 8
@@ -73,13 +73,13 @@ jobs:
             browser-channel: msedge
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Media Pack
         if: matrix.os == 'windows-latest'
         shell: powershell
         run: Install-WindowsFeature Server-Media-Foundation
       - name: Set up JDK 1.8
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: zulu
           java-version: 8
@@ -108,9 +108,9 @@ jobs:
         browser: [chromium, firefox, webkit]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: adopt
           java-version: 21
diff --git a/.github/workflows/test_cli.yml b/.github/workflows/test_cli.yml
index 8d6c0cb11..9f61bdd4c 100644
--- a/.github/workflows/test_cli.yml
+++ b/.github/workflows/test_cli.yml
@@ -13,9 +13,9 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Cache Maven packages
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/test_docker.yml b/.github/workflows/test_docker.yml
index 7512941d6..36b07f466 100644
--- a/.github/workflows/test_docker.yml
+++ b/.github/workflows/test_docker.yml
@@ -34,7 +34,7 @@ jobs:
           - runs-on: ubuntu-24.04-arm
             arch: arm64
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Docker image
         run: |
           bash utils/docker/build.sh --${{ matrix.arch }} ${{ matrix.flavor }} playwright-java:localbuild-${{ matrix.flavor }}
diff --git a/.github/workflows/verify_api.yml b/.github/workflows/verify_api.yml
index a67da2807..8cedfb20f 100644
--- a/.github/workflows/verify_api.yml
+++ b/.github/workflows/verify_api.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download drivers
         run: scripts/download_driver.sh
       - name: Regenerate APIs