Azure · Dan Fiedler (danfiedler-msft) · Aug 29, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -5,4 +5,6 @@ updates:
     schedule:
       interval: "daily"
     labels:
-      - "dependencies"
+      - "dependencies"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
@@ -31,7 +31,7 @@ jobs:
     if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Typo file contents check
         shell: bash
         run: cat ./.github/_typos.toml
@@ -50,8 +50,8 @@ jobs:
       name: github-pages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: 3.x
       - run: pip install mkdocs mkdocs-material mkdocs-minify-plugin mkdocs-git-committers-plugin-2 mkdocs-git-revision-date-localized-plugin

diff --git a/.github/workflows/greet.yml b/.github/workflows/greet.yml
@@ -11,7 +11,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/first-interaction@v3.0.0
+      - uses: actions/first-interaction@753c925c8d1ac6fede23781875376600628d9b5d # v3.0.0
         continue-on-error: true
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}

diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
@@ -17,8 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Clone repo
-      uses: actions/checkout@v5
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
     - name: Add label
-      uses: actions/labeler@v6.0.1
+      uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
       with:
         sync-labels: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -23,10 +23,10 @@ jobs:
       contents: write
     steps:
       - name: Github Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Azure Login
-        uses: Azure/login@v2
+        uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ env.AZURE_CLIENT_ID }}
           tenant-id: ${{ env.AZURE_TENANT_ID }}
@@ -37,7 +37,7 @@ jobs:
 
       - name: Bump Version and Get Next Tag
         id: bump_version
-        uses: anothrNick/github-tag-action@1.75.0
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           WITH_V: true
@@ -58,7 +58,7 @@ jobs:
           /home/runner/.azure/bin/bicep build bicep/main.bicep --outfile azuredeploy.json
 
       - name: Commit Changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           message: "Performing Release ${{ steps.bump_version.outputs.new_tag }}"
           add: |
@@ -67,14 +67,14 @@ jobs:
 
       - name: Generate Changelog
         id: github_release
-        uses: mikepenz/release-changelog-builder-action@v5
+        uses: mikepenz/release-changelog-builder-action@c9dc8369bccbc41e0ac887f8fd674f5925d315f7 # v5.4.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           configuration: ".github/changelog_config.json"
 
       - name: Create Release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ steps.bump_version.outputs.new_tag }}  # Use directly the tag from bump_version
           artifacts: "azuredeploy.json"

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -79,10 +79,10 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' || github.event.inputs.doStandards == 'true'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Azure Login
-        uses: Azure/login@v2
+        uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ env.AZURE_CLIENT_ID }}
           tenant-id: ${{ env.AZURE_TENANT_ID }}
@@ -95,7 +95,7 @@ jobs:
       # PSRule performs IaC recommendations of the template.
       # https://azure.github.io/PSRule.Rules.Azure/
       - name: PSRule for Azure - Well Architected
-        uses: microsoft/ps-rule@v2.9.0
+        uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
         continue-on-error: true #Setting this whilst PSRule gets bedded in, in this project
         with:
           modules: "PSRule.Rules.Azure"
@@ -110,7 +110,7 @@ jobs:
       REGION: ${{ steps.params.outputs.REGION}}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Job parameter check
         if: github.event.inputs.doDebugSteps == 'true'
@@ -167,7 +167,7 @@ jobs:
           fi
 
       - name: Azure Login
-        uses: Azure/login@v2
+        uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ env.AZURE_CLIENT_ID }}
           tenant-id: ${{ env.AZURE_TENANT_ID }}
@@ -187,7 +187,7 @@ jobs:
         env:
           RESOURCE_GROUP: ${{ steps.params.outputs.RESOURCEGROUP }}
           LOCATION: ${{ steps.params.outputs.REGION }}
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -207,7 +207,7 @@ jobs:
         if: github.event.inputs.doVerifySteps == 'true'
         env:
           RESOURCE_GROUP: ${{ steps.params.outputs.RESOURCEGROUP }}
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -249,7 +249,7 @@ jobs:
           }
 
       - name: Create Parameter file imperative override string
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         id: imperitiveparams
         env:
           RESOURCE_GROUP: ${{ steps.params.outputs.RESOURCEGROUP }}
@@ -261,7 +261,7 @@ jobs:
             echo "PARAMOVERRIDES=$PARAMOVERRIDES" >> $GITHUB_OUTPUT
 
       - name: Validate Infrastructure deployment
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         env:
           RESOURCE_GROUP: ${{ steps.params.outputs.RESOURCEGROUP }}
           AZURE_CLIENT_PRINCIPAL_OID: ${{ vars.AZURE_PRINCIPAL_ID }}
@@ -275,7 +275,7 @@ jobs:
             az deployment group validate -f bicep/main.bicep -g $RESOURCE_GROUP -p ${{ env.ParamFilePath }} -p $PARAMS --verbose
 
       - name: What If
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         id: whatif
         env:
           RESOURCE_GROUP: ${{ steps.params.outputs.RESOURCEGROUP }}
@@ -325,10 +325,10 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Install azd
-        uses: Azure/setup-azd@v2.2.0
+        uses: Azure/setup-azd@cf638ffd167fc81e1851241a478a723c05fa9cb3 # v2.2.0
 
       - name: Log in with Azure (Federated Credentials)
         if: ${{ env.AZURE_CLIENT_ID != '' }}
@@ -364,7 +364,7 @@ jobs:
     env:
       RESOURCE_GROUP: ${{ needs.Validate.outputs.RESOURCEGROUP }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Param check
         if: github.event.inputs.doDebugSteps == 'true'
@@ -374,7 +374,7 @@ jobs:
           echo "Deployment name is ${{ env.DEPNAME }}"
 
       - name: Azure Login
-        uses: Azure/login@v2
+        uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ env.AZURE_CLIENT_ID }}
           tenant-id: ${{ env.AZURE_TENANT_ID }}
@@ -444,10 +444,10 @@ jobs:
     if: always()  # This ensures the cleanup job always runs
     timeout-minutes: 120  # This sets a timeout of 2 hours for the cleanup job
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Azure Login
-        uses: Azure/login@v2
+        uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ env.AZURE_CLIENT_ID }}
           tenant-id: ${{ env.AZURE_TENANT_ID }}
@@ -457,7 +457,7 @@ jobs:
           allow-no-subscriptions: false
 
       - name: Delete Resource Group
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         continue-on-error: true
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
@@ -471,7 +471,7 @@ jobs:
             fi
 
       - name: Purge Deleted Key Vaults
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -483,7 +483,7 @@ jobs:
             done
 
       - name: Purge Deleted App Configurations
-        uses: azure/CLI@v2
+        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |

diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
@@ -22,30 +22,30 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=ref,event=branch,pattern=main  # Tag with 'main' if built from the main branch
             type=ref,event=branch,pattern=main,latest  # Also tag as 'latest' if built from the main branch
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: web
           file: web/Dockerfile
@@ -55,7 +55,7 @@ jobs:
           platforms: linux/amd64,linux/arm64  # Build for both amd64 and arm64 architectures
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}