From d86c8bdacd54ffe60d4fc9ac5e3422e94d1de941 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 20 Aug 2026 16:18:35 +0000
Subject: [PATCH 1/3] Initial plan


From 60dd537c04999e1f322ef5f86f05e9d916e258ca Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 20 Aug 2026 16:21:18 +0000
Subject: [PATCH 2/3] Pin GitHub Actions to commit SHAs

Co-authored-by: mthalman <15789599+mthalman@users.noreply.github.com>
---
 .github/dependabot.yml         | 8 ++++++++
 .github/workflows/backport.yml | 2 +-
 .github/workflows/labeler.yml  | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..9cbb9b7c4e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 60eb59ab40..872c4546d9 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   backport:
-    uses: dotnet/arcade/.github/workflows/backport-base.yml@main
+    uses: dotnet/arcade/.github/workflows/backport-base.yml@a18c4ece1b67d70252b4cff6c562a7c2697adebe
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 4198a6044f..4e35918740 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -11,7 +11,7 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: github/issue-labeler@v3.4
+    - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
       with:
         configuration-path: .github/labeler.yml
         enable-versioned-regex: 0

From 1fda4a0f96f426b837272b3b6c57c56ea560d39e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 20 Aug 2026 18:18:56 +0000
Subject: [PATCH 3/3] Add Dependabot branch hint comment for backport workflow
 pin

Co-authored-by: mthalman <15789599+mthalman@users.noreply.github.com>
---
 .github/workflows/backport.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 872c4546d9..e4e20c54b0 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   backport:
-    uses: dotnet/arcade/.github/workflows/backport-base.yml@a18c4ece1b67d70252b4cff6c562a7c2697adebe
+    uses: dotnet/arcade/.github/workflows/backport-base.yml@a18c4ece1b67d70252b4cff6c562a7c2697adebe # main