Apply security best practices for GitHub Actions / Dependency

[Nick2bad4u]

Summary of the Pull Request

This pull request implements security best practices by pinning all GitHub Action tags and Docker tags to their full-length commits, following recommendations from GitHub's Security Hardening Guide. Pinning ensures that the actions used in workflows are immutable, reducing the risk posed by unintended or malicious changes.

Additionally, this PR integrates the Dependency Review Workflow, which scans for vulnerable dependency versions introduced by pull requests. This feature provides early warnings about security vulnerabilities, increasing visibility into changes and preventing vulnerabilities from being introduced into the repository.

References:

• GitHub Security Guide
• Open Source Security Foundation (OpenSSF) Security Guide
• GitHub Guide for Dependency Review
• Configuring Dependency Review Action

---

PR Checklist

• Closes: Security improvement initiative (no issue linked)
• Communication: N/A
• Tests: Dependency review action tested in a local branch and validated for correctness.
• Localization: No user-facing strings affected.
• Dev docs: Updated with steps to configure dependency review.
• New binaries: Not applicable for this PR.
• Documentation updated: N/A

---

Detailed Description of the Pull Request / Additional Comments

This PR focuses on hardening the repository by ensuring immutability for tags and introducing automated dependency checks. The steps undertaken include:

1. Pinning action tags and Docker tags to full-length commit hashes.
2. Adding the Dependency Review Workflow to identify vulnerabilities at the pull request level.

These changes are aimed at improving the overall security posture of the repository and aligning it with recognized security standards.

---

Validation Steps Performed

1. Verified that workflows run successfully with pinned tags.
2. Tested the Dependency Review Workflow on multiple pull requests to confirm detection of vulnerable dependencies.
3. Reviewed configurations against GitHub's and OpenSSF's security guidelines.

[Nick2bad4u]

@microsoft-github-policy-service agree

[yeelam-gordon]

Thanks for raising the PR.
Quick question, how come overlap will this dependency check with https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates?

[crutkas]

@Nick2bad4u, i submitted a PR to your repo with some adjustments based on chatting with some people internally.

[Nick2bad4u]

@Nick2bad4u, i submitted a PR to your repo with some adjustments based on chatting with some people internally.

I didn't even know if I was going to submit this, so I left it as a draft.

The only reason I say this is because it can be a pain to constantly have to merge the version updates to any actions, etc.

So it's more of a trade off of security vs convenience. Ill take a look at your adjustment when I get home in a bit here.

Thanks

[Nick2bad4u]

Thanks for raising the PR.
Quick question, how come overlap will this dependency check with https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates?

This checks the dependency for version updates as they won't automatically update to the latest version after pinning to a hash.

It creates a pr for the new updates if that's what you're asking.

It also warns about any dependency you may be using that has open security risk.

[crutkas]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[crutkas]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

[yeelam-gordon]

@Nick2bad4u, i submitted a PR to your repo with some adjustments based on chatting with some people internally.

I didn't even know if I was going to submit this, so I left it as a draft.

The only reason I say this is because it can be a pain to constantly have to merge the version updates to any actions, etc.

So it's more of a trade off of security vs convenience. Ill take a look at your adjustment when I get home in a bit here.

Thanks

We need to do the hash for the 3rd party action from https://docs.opensource.microsoft.com/security/tsg/actions/#requirements-for-security-hardening-your-own-github-actions, thus, I see the latest change is great (i.e. those 1st/2nd party doesn't specify for hash.

[yeelam-gordon]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[yeelam-gordon]

Thanks @Nick2bad4u for all the change.
I also added Microsoft Security guideline as part of the dependency-review.yml, and rebased on from latest report for test run.

[crutkas]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[yeelam-gordon]

Oh, I see your fix @crutkas , just aware we should consider https://github.com/actions/ as 2nd party.