Pin GitHub Actions to full-length commit SHAs

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/kubectl-aks.yml

@@ -36,12 +36,12 @@ jobs:
             arch: arm64
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
       - name: Cache Go
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: |
             ~/.cache/go-build
@@ -50,7 +50,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Build and generate tarball
         run: |
           target=kubectl-aks-${{ matrix.os }}-${{ matrix.arch }}
@@ -68,7 +68,7 @@ jobs:
             -czf ${target}.tar.gz \
             $binary_name LICENSE
       - name: Add kubectl-aks-${{ matrix.os }}-${{ matrix.arch }}.tar.gz as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: kubectl-aks-${{ matrix.os }}-${{ matrix.arch }}-tar-gz
           path: kubectl-aks-${{ matrix.os }}-${{ matrix.arch }}.tar.gz
@@ -77,14 +77,14 @@ jobs:
     name: Run linter
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
       - name: Lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
         with:
           # This version number must be kept in sync with Makefile lint one.
           version: v1.64.8
@@ -98,14 +98,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Cache Go
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: |
             ~/.cache/go-build
@@ -121,9 +121,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ build, unit-tests ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with:
           go-version: '>=1.20.0' # ie requires go 1.20+
           check-latest: true
@@ -152,9 +152,9 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
     # Checkout the repo to get the .krew.yaml file
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Get all artifacts.
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
     - name: Rename all artifacts to kubectl-aks-${{ github.ref_name }}.tar.gz
       shell: bash
       run: |
@@ -163,13 +163,13 @@ jobs:
         done
     - name: Create Draft Release
       id: create_release
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         name: Release ${{ github.ref_name }}
         draft: true
     - name: Upload kubectl-aks binaries to the release
-      uses: csexton/release-asset-action@v2
+      uses: csexton/release-asset-action@73f9d3bb8efa2547046ae5130a5c4597e983d543 # v2
       with:
         pattern: "kubectl-aks-*-*-tar-gz/kubectl-aks-*-*.tar.gz"
         github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -12,8 +12,8 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Update new version in krew-index
       if: github.repository == 'azure/kubectl-aks'
-      uses: rajatjindal/krew-release-bot@v0.0.46
+      uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46