From 188937e24d9078bfedc5b18fdf97e13e0beaee68 Mon Sep 17 00:00:00 2001
From: Mahangu Weerasinghe <mahangu.weerasinghe@automattic.com>
Date: Mon, 8 Jun 2026 07:46:21 +0530
Subject: [PATCH] chore: pin third-party GitHub Actions to commit SHAs

Tracking: DEVPROD-1072
---
 .github/dependabot.yml        | 22 ++++++++++++++++++++++
 .github/workflows/phpcs.yml   |  2 +-
 .github/workflows/phpunit.yml |  4 ++--
 .github/workflows/release.yml |  2 +-
 4 files changed, 26 insertions(+), 4 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7ddd384
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml
index f822fe5..46d5307 100644
--- a/.github/workflows/phpcs.yml
+++ b/.github/workflows/phpcs.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v2
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           tools: composer
           php-version: ${{ matrix.php-versions }}
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 9da69f0..ccdbc28 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -38,13 +38,13 @@ jobs:
         run: npm -g install @wordpress/env
 
       - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php }}
           tools: composer
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@v3
+        uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1
         with:
           composer-options: --prefer-dist --no-progress
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6614e3c..cbf1af9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Create Release
         if: steps.version_check.outputs.new_version
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ steps.version_check.outputs.new_version }}
           files: vip-block-data-api-${{ steps.version_check.outputs.new_version }}.zip