Merge pull request #4808 from github/pinner/actions-sha-pins-2026-09-10

Pin GitHub Actions to commit SHAs

Author: github-security-bot

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/close-single-word-issues.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Close Single-Word Issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/no-response.yml

@@ -13,7 +13,7 @@ jobs:
   noResponse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           only-issue-labels: 'more-info-needed'

.github/workflows/stale-issues.yml

@@ -10,7 +10,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           stale-issue-label: 'stale, triage' # The label that will be added to the issues when automatically marked as stale
           start-date: '2025-01-01T00:00:00Z' # Skip stale action for issues created before it