From c8a3ad3dec1a679df58b100a5e439f683909aa03 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 24 Jun 2026 07:16:22 +0000
Subject: [PATCH 1/2] Initial plan


From 20d32525bdf0f03b0874cd411f3d5816fcdbb86c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 24 Jun 2026 07:32:59 +0000
Subject: [PATCH 2/2] Pin workflow actions to immutable SHAs

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/aoai-endpoint-smoke-test.yml  | 2 +-
 .github/workflows/publish-safe-outputs-node.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/aoai-endpoint-smoke-test.yml b/.github/workflows/aoai-endpoint-smoke-test.yml
index 73d1aa256b6..57be26f352a 100644
--- a/.github/workflows/aoai-endpoint-smoke-test.yml
+++ b/.github/workflows/aoai-endpoint-smoke-test.yml
@@ -31,7 +31,7 @@ jobs:
       AZURE_SUBSCRIPTION_ID: 606c8d64-a781-4e22-94d6-937f051e26e9
     steps:
       - name: Azure Login (OIDC)
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
         with:
           client-id: ${{ env.AZURE_CLIENT_ID }}
           tenant-id: ${{ env.AZURE_TENANT_ID }}
diff --git a/.github/workflows/publish-safe-outputs-node.yml b/.github/workflows/publish-safe-outputs-node.yml
index 135145173e1..3a64b829fed 100644
--- a/.github/workflows/publish-safe-outputs-node.yml
+++ b/.github/workflows/publish-safe-outputs-node.yml
@@ -91,7 +91,7 @@ jobs:
           echo "hash=$hash" >> "$GITHUB_OUTPUT"
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -186,7 +186,7 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.decision.outputs.should_push == 'true'
-        uses: docker/setup-buildx-action@v4.1.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build and push gh-aw-node
         if: steps.decision.outputs.should_push == 'true'