Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/codeql-coding-standards to immutable commit SHAs.

Summary

Metric	Count
Files changed	20
Files scanned	19
Refs found	69
Refs pinned	69
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/code-scanning-pack-gen.yml:30	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/code-scanning-pack-gen.yml:46	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/code-scanning-pack-gen.yml:50	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag
.github/workflows/code-scanning-pack-gen.yml:66	actions/cache/restore@v6	actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	tag
.github/workflows/code-scanning-pack-gen.yml:95	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/code-scanning-pack-gen.yml:127	actions/cache/save@v6	actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	tag
.github/workflows/code-scanning-pack-gen.yml:133	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/code-scanning-pack-gen.yml:155	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/codeql_unit_tests.yml:27	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/codeql_unit_tests.yml:49	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/codeql_unit_tests.yml:52	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/codeql_unit_tests.yml:61	actions/cache@v6	actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	tag
.github/workflows/codeql_unit_tests.yml:79	actions/cache/restore@v6	actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	tag
.github/workflows/codeql_unit_tests.yml:101	actions/cache/save@v6	actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	tag
.github/workflows/codeql_unit_tests.yml:173	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/codeql_unit_tests.yml:188	actions/github-script@v9	actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3	tag
.github/workflows/codeql_unit_tests.yml:193	actions/download-artifact@v8	actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	tag
.github/workflows/dispatch-matrix-test-on-comment.yml:16	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/dispatch-matrix-test-on-comment.yml:26	actions/create-github-app-token@v3	actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1	tag
.github/workflows/dispatch-matrix-test-on-comment.yml:47	actions/github-script@v9	actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3	tag
.github/workflows/dispatch-release-performance-check.yml:16	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/dispatch-release-performance-check.yml:26	actions/create-github-app-token@v3	actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1	tag
.github/workflows/dispatch-release-performance-check.yml:47	actions/github-script@v9	actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3	tag
.github/workflows/extra-rule-validation.yml:26	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/extra-rule-validation.yml:38	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/extra-rule-validation.yml:49	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/extra-rule-validation.yml:55	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/finalize-release.yml:47	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/finalize-release.yml:54	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/finalize-release.yml:60	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/finalize-release.yml:111	actions/create-github-app-token@v3	actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1	tag
.github/workflows/generate-html-docs.yml:25	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/generate-html-docs.yml:28	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/generate-html-docs.yml:40	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/prepare-release.yml:37	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/prepare-release.yml:42	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/prepare-release.yml:146	actions/create-github-app-token@v3	actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1	tag
.github/workflows/standard_library_upgrade_tests.yml:24	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/standard_library_upgrade_tests.yml:46	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/standard_library_upgrade_tests.yml:49	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/standard_library_upgrade_tests.yml:55	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag
.github/workflows/standard_library_upgrade_tests.yml:148	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/standard_library_upgrade_tests.yml:162	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/standard_library_upgrade_tests.yml:167	actions/download-artifact@v8	actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	tag
.github/workflows/tooling-unit-tests.yml:27	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/tooling-unit-tests.yml:45	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/tooling-unit-tests.yml:48	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag
.github/workflows/tooling-unit-tests.yml:57	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag
.github/workflows/tooling-unit-tests.yml:88	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/tooling-unit-tests.yml:91	actions/setup-python@v6	actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1	tag

...and 19 more omitted from this PR body.

Dependabot

• Added a 7-day cooldown (cooldown: default-days: 7) to the existing github-actions Dependabot configuration.
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All external action references use full commit SHAs, and the Dependabot configuration is valid.

Pull request overview

Pins GitHub Actions dependencies to immutable SHAs, preventing tag retargeting from silently changing workflow behavior.

Changes:

• Pins 69 action references while retaining version comments.
• Adds a seven-day Dependabot cooldown.
• No change note is required because query behavior and release artifacts are unchanged.

File summaries

File	Description
.github/dependabot.yml	Adds the update cooldown.
.github/workflows/code-scanning-pack-gen.yml	Pins pack-generation actions.
.github/workflows/codeql_unit_tests.yml	Pins CodeQL test actions.
.github/workflows/dispatch-matrix-test-on-comment.yml	Pins dispatch actions.
.github/workflows/dispatch-release-performance-check.yml	Pins performance-dispatch actions.
.github/workflows/extra-rule-validation.yml	Pins validation actions.
.github/workflows/finalize-release.yml	Pins release-finalization actions.
.github/workflows/generate-html-docs.yml	Pins documentation actions.
.github/workflows/prepare-release.yml	Pins release-preparation actions.
.github/workflows/standard_library_upgrade_tests.yml	Pins upgrade-test actions.
.github/workflows/tooling-unit-tests.yml	Pins tooling-test actions.
.github/workflows/update-release-status.yml	Pins the checkout action.
.github/workflows/update-release.yml	Pins release-update actions.
.github/workflows/upgrade_codeql_dependencies.yml	Pins dependency-upgrade actions.
.github/workflows/validate-package-files.yml	Pins package-validation actions.
.github/workflows/validate-query-formatting.yml	Pins the checkout action.
.github/workflows/validate-query-help.yml	Pins the checkout action.
.github/workflows/validate-query-test-case-formatting.yml	Pins the checkout action.
.github/workflows/validate-release.yml	Pins token-generation actions.
.github/workflows/verify-standard-library-dependencies.yml	Pins dependency-verification actions.

Review details

• Files reviewed: 20/20 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.