On branch edburns/dd-2785864-pre-public-non-code-changes Pin actions …

…to specific SHA per request from @karianna modified: .github/workflows/build-test.yml modified: .github/workflows/copilot-setup-steps.yml modified: .github/workflows/deploy-site.yml modified: .github/workflows/publish-maven.yml modified: .github/workflows/publish-snapshot.yml modified: .github/workflows/weekly-upstream-sync.yml > prefer #commmit versions e.g., actions/checkout@#4s9df7sdf98d7f8s9df7sd9f87ds #v6.0.0 modified: src/site/markdown/advanced.md > I think we can word that differently as we are the official SDK.
github · edburns · Mar 16, 2026 · Mar 5, 2026 · Mar 6, 2026 · Mar 9, 2026
commit d9a8603cd07fd55bfc96a2c8b80b00d7c9f5184c
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
@@ -32,11 +32,11 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 22
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: "17"
           distribution: "temurin"
@@ -78,7 +78,7 @@ jobs:
 
       - name: Upload test results for site generation
         if: success() && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: test-results-for-site
           path: |

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
@@ -20,22 +20,22 @@ jobs:
     steps:
       # Clone the repository
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Install GitHub CLI and gh-aw extension for Copilot Agent interaction
       - name: Install gh-aw extension
-        uses: github/gh-aw/actions/setup-cli@v0.42.17
+        uses: github/gh-aw/actions/setup-cli@7a970851c1090295e55a16e549c61ba1ce227f16 # v0.42.17
         with:
           version: v0.42.17
 
       # Setup Node.js
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: 22
 
       # Set up JDK 17
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '17'
           distribution: 'temurin'

diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml
@@ -56,19 +56,19 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: gh-pages
           path: site
@@ -120,7 +120,7 @@ jobs:
 
       - name: Download test results from Build & Test
         if: steps.tags.outputs.is_release == 'false' && inputs.rebuild_all_versions != true && github.event_name == 'workflow_run'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: test-results-for-site
           path: /tmp/test-results
@@ -293,13 +293,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: 'site'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
diff --git a/.github/workflows/publish-maven.yml b/.github/workflows/publish-maven.yml
@@ -38,7 +38,7 @@ jobs:
         outputs:
             version: ${{ steps.versions.outputs.release_version }}
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
                   token: ${{ secrets.GITHUB_TOKEN }}
@@ -51,10 +51,10 @@ jobs:
             - uses: ./.github/actions/setup-copilot
 
             - name: Set up JDK 17
-              uses: actions/setup-java@v5
+              uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
               with:
                   java-version: "17"
-                  distribution: "temurin"
+                  distribution: "microsoft"
                   cache: "maven"
                   server-id: central
                   server-username: MAVEN_USERNAME
@@ -169,7 +169,7 @@ jobs:
         if: github.ref == 'refs/heads/main'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
             - name: Create GitHub Release

diff --git a/.github/workflows/publish-snapshot.yml b/.github/workflows/publish-snapshot.yml
@@ -18,17 +18,17 @@ jobs:
         name: Publish SNAPSHOT to Maven Central
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
 
             - uses: ./.github/actions/setup-copilot
 
             - name: Set up JDK 17
-              uses: actions/setup-java@v5
+              uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
               with:
                   java-version: "17"
-                  distribution: "temurin"
+                  distribution: "microsoft"
                   cache: "maven"
                   server-id: central
                   server-username: MAVEN_USERNAME

diff --git a/.github/workflows/weekly-upstream-sync.lock.yml b/.github/workflows/weekly-upstream-sync.lock.yml
diff --git a/.github/workflows/weekly-upstream-sync.yml b/.github/workflows/weekly-upstream-sync.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for upstream changes
         id: check

diff --git a/src/site/markdown/advanced.md b/src/site/markdown/advanced.md
@@ -1,6 +1,6 @@
 # Advanced Usage
 
-> ⚠️ **Disclaimer:** This SDK tracks the pre-GA GitHub Copilot SDKs for .NET and nodejs. This SDK may change in breaking ways. Use at your own risk.
+> **Disclaimer:** This is the official Java SDK for GitHub Copilot. This repository treats the official .NET and nodejs SDKs for GitHub Copilot as reference implementations. These SDKS are all officially supported as GitHub open source projects. The Java implementation follows the backward compatibility guarantees offered by the reference implementations. As such this implementation may introduce breaking changes, according to the policy declared by the reference implementations. Use at your own risk.
 
 This guide covers advanced scenarios for extending and customizing your Copilot integration.