Bump the github-actions group with 2 updates (#19964)

Bumps the github-actions group with 2 updates:
[actions/setup-dotnet](https://github.com/actions/setup-dotnet) and
[stefanzweifel/git-auto-commit-action](https://github.com/stefanzweifel/git-auto-commit-action).

Updates `actions/setup-dotnet` from 5.3.0 to 5.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's
releases</a>.</em></p>
<blockquote>
<h2>v5.4.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Improve global.json SDK version validation for rollForward by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/742">actions/setup-dotnet#742</a></li>
<li>Pin actions to commit SHAs in workflows by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/744">actions/setup-dotnet#744</a></li>
<li>Expand the CSC problem matcher to light up more errors on GitHub. by
<a
href="https://github.com/StephenCleary"><code>@​StephenCleary</code></a>
in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Docs(action): Explicitly mark all optional inputs with required:
false by <a
href="https://github.com/kranthipoturaju"><code>@​kranthipoturaju</code></a>
in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fix global.json creation command by <a
href="https://github.com/michal2612"><code>@​michal2612</code></a> in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li>
<li><a
href="https://github.com/michal2612"><code>@​michal2612</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li>
<li><a
href="https://github.com/kranthipoturaju"><code>@​kranthipoturaju</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li>
<li><a
href="https://github.com/StephenCleary"><code>@​StephenCleary</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-dotnet/compare/v5...v5.4.0">https://github.com/actions/setup-dotnet/compare/v5...v5.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1"><code>26b0ec1</code></a>
Expand the CSC problem matcher to light up more errors on GitHub. (<a
href="https://redirect.github.com/actions/setup-dotnet/issues/717">#717</a>)</li>
<li><a
href="https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e"><code>da5e548</code></a>
docs(action): explicitly mark all optional inputs with required: false
(<a
href="https://redirect.github.com/actions/setup-dotnet/issues/737">#737</a>)</li>
<li><a
href="https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab"><code>9bd3b44</code></a>
Improve readability of global.json creation command (<a
href="https://redirect.github.com/actions/setup-dotnet/issues/694">#694</a>)</li>
<li><a
href="https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c"><code>4406a63</code></a>
Bump <code>@​actions/cache</code> to 5.1.0, log cache write denied (<a
href="https://redirect.github.com/actions/setup-dotnet/issues/746">#746</a>)</li>
<li><a
href="https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738"><code>dc3262d</code></a>
pin actions to commit SHAs in workflows (<a
href="https://redirect.github.com/actions/setup-dotnet/issues/744">#744</a>)</li>
<li><a
href="https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49"><code>95a3f8b</code></a>
Validate global.json SDK version before rollForward optimization (<a
href="https://redirect.github.com/actions/setup-dotnet/issues/742">#742</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-dotnet/compare/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2...26b0ec14cb23fa6904739307f278c14f94c95bf1">compare
view</a></li>
</ul>
</details>
<br />

Updates `stefanzweifel/git-auto-commit-action` from 7.1.0 to 7.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stefanzweifel/git-auto-commit-action/releases">stefanzweifel/git-auto-commit-action's
releases</a>.</em></p>
<blockquote>
<h2>v7.2.0</h2>
<h2>Added</h2>
<ul>
<li>Add hooks to run shell snippets around git operations (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/411">#411</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
<li>Emit warning for pull_request_target trigger usage (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/410">#410</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
</ul>
<h2>Fixed</h2>
<ul>
<li>docs(action): fix input and output descriptions in action.yml (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/406">#406</a>)
<a
href="https://github.com/@kranthipoturaju"><code>@​kranthipoturaju</code></a></li>
<li>docs: fix typos, grammar, and formatting across markdown files (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/408">#408</a>)
<a
href="https://github.com/@kranthipoturaju"><code>@​kranthipoturaju</code></a></li>
<li>docs: fix broken and redirecting URLs in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/407">#407</a>)
<a
href="https://github.com/@kranthipoturaju"><code>@​kranthipoturaju</code></a></li>
<li>README: clearify meaning of the repository field (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/404">#404</a>)
<a href="https://github.com/@gucio321"><code>@​gucio321</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/409">#409</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
<li>Bump release-drafter/release-drafter from 6 to 7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/403">#403</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/stefanzweifel/git-auto-commit-action/blob/master/CHANGELOG.md">stefanzweifel/git-auto-commit-action's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this
file.</p>
<p>The format is based on <a
href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>
and this project adheres to <a
href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.2.0...HEAD">Unreleased</a></h2>
<blockquote>
<p>TBD</p>
</blockquote>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.1.0...v7.2.0">v7.2.0</a>
- 2026-06-28</h2>
<h3>Added</h3>
<ul>
<li>Add hooks to run shell snippets around git operations (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/411">#411</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
<li>Emit warning for pull_request_target trigger usage (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/410">#410</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>docs(action): fix input and output descriptions in action.yml (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/406">#406</a>)
<a
href="https://github.com/@kranthipoturaju"><code>@​kranthipoturaju</code></a></li>
<li>docs: fix typos, grammar, and formatting across markdown files (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/408">#408</a>)
<a
href="https://github.com/@kranthipoturaju"><code>@​kranthipoturaju</code></a></li>
<li>docs: fix broken and redirecting URLs in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/407">#407</a>)
<a
href="https://github.com/@kranthipoturaju"><code>@​kranthipoturaju</code></a></li>
<li>README: clearify meaning of the repository field (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/404">#404</a>)
<a href="https://github.com/@gucio321"><code>@​gucio321</code></a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/409">#409</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
<li>Bump release-drafter/release-drafter from 6 to 7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/403">#403</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.0.0...v7.1.0">v7.1.0</a>
- 2025-12-17</h2>
<h3>Added</h3>
<ul>
<li>Add skip_push input option (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/401">#401</a>)
<a
href="https://github.com/@kvanzuijlen"><code>@​kvanzuijlen</code></a></li>
</ul>
<h3>Changes</h3>
<ul>
<li>docs: fix typo in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/400">#400</a>)
<a
href="https://github.com/@GideonBear"><code>@​GideonBear</code></a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump actions/checkout from 5 to 6 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/399">#399</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
<li>Bump bats from 1.12.0 to 1.13.0 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/398">#398</a>)
[@<a href="https://github.com/apps/dependabot">dependabot[bot]</a>](<a
href="https://github.com/@%5Bdependabot%5Bbot%5D%5D(https://github.com/apps/dependabot)">https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot)</a>)</li>
</ul>
<h2><a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.1...v7.0.0">v7.0.0</a>
- 2025-10-12</h2>
<h3>Added</h3>
<ul>
<li>Restore skip_fetch, skip_checkout, create_branch (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/pull/388">#388</a>)
<a
href="https://github.com/@stefanzweifel"><code>@​stefanzweifel</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/4a55954c782fc1ea30b9056cd3e7a2b40ca8887d"><code>4a55954</code></a>
Update README.md</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/9f6c933320c44425cf7ea45b6e16bfe90e271fa0"><code>9f6c933</code></a>
Add hooks to run shell snippets around git operations (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/411">#411</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/c365a749b49f73199b8f7125f4d4ab6dfac90802"><code>c365a74</code></a>
Emit warning for pull_request_target trigger usage (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/410">#410</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/d28176c21fcd0cb43d5b5cf374322d8956224019"><code>d28176c</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/409">#409</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/25df622d80fcf2b5fb70bfa5b4ec0871f574881a"><code>25df622</code></a>
Add EXAMPLES.md</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/32e98448120552541e630c7992836985b7c00748"><code>32e9844</code></a>
docs(action): fix input and output descriptions in action.yml (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/406">#406</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/a3ed46f7fde121393bfde63d43ae6c1d306b212d"><code>a3ed46f</code></a>
docs: fix typos, grammar, and formatting across markdown files (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/408">#408</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/b4d688c2241cae5a43003f0a0108bae3b3f25146"><code>b4d688c</code></a>
docs: fix broken and redirecting URLs in README.md (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/407">#407</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/f53a62c26ed5971dd2ed8768e4142f08c767ea37"><code>f53a62c</code></a>
README: clearify meaning of the repository field (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/404">#404</a>)</li>
<li><a
href="https://github.com/stefanzweifel/git-auto-commit-action/commit/4fc4bbf34c756a23fa53d40bc01e8ddd276d51b9"><code>4fc4bbf</code></a>
Bump release-drafter/release-drafter from 6 to 7 (<a
href="https://redirect.github.com/stefanzweifel/git-auto-commit-action/issues/403">#403</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/stefanzweifel/git-auto-commit-action/compare/04702edda442b2e678b25b537cec683a1493fcb9...4a55954c782fc1ea30b9056cd3e7a2b40ca8887d">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/Azure/bicep/pull/19964)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Publish Bicep
         run: dotnet publish --configuration release --self-contained true -r ${{ matrix.rid }} ./src/Bicep.Cli/Bicep.Cli.csproj
@@ -82,7 +82,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Pack
         run: dotnet pack --configuration release
@@ -112,7 +112,7 @@ jobs:
           node-version: 24
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Publish Language Server
         run: |
@@ -252,7 +252,7 @@ jobs:
           node-version: 24
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Publish Language Server
         run: |
@@ -323,7 +323,7 @@ jobs:
 
       # needed by the GenerateNotice package
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Add msbuild to PATH
         uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
@@ -381,7 +381,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Download Bicep CLI
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -444,7 +444,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -523,7 +523,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -563,7 +563,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -609,7 +609,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -665,7 +665,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -736,7 +736,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Run Tests
         run: dotnet test --configuration release -- --filter '${{ matrix.config.filter }}' --report-trx --results-directory ${{ github.workspace }}/TestResults
@@ -832,7 +832,7 @@ jobs:
           node-version: 24
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Download Bicep CLI
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
           languages: csharp, javascript
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Add msbuild to PATH
         uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3

.github/workflows/github-pages.yml

@@ -25,7 +25,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/lockfiles-command.yml

@@ -22,7 +22,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Restore dotnet dependencies
         run: |
@@ -37,7 +37,7 @@ jobs:
           & .\npm-install.bat
         working-directory: src/vscode-bicep
 
-      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
+      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7
         with:
           commit_message: Update lockfiles
           commit_user_name: ${{ github.actor }}

.github/workflows/run-benchmarks.yml

@@ -21,7 +21,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Run Benchmarks
         run: dotnet run --configuration Release --project src/Bicep.Tools.Benchmark -- --filter '*' --profiler EP

.github/workflows/run-formatter.yml

@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/test-azure-cli-integration.yml

@@ -24,7 +24,7 @@ jobs:
           submodules: true
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Publish Bicep CLI
         run: dotnet publish --configuration release --self-contained true -r linux-x64 ./src/Bicep.Cli/Bicep.Cli.csproj

.github/workflows/update-baselines.yml

@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Test
         continue-on-error: true

.github/workflows/update-dependencies.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/update-notices.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 
       - name: Setup .NET Core
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -85,7 +85,7 @@ jobs:
         run: msbuild src/vs-bicep/BicepInVisualStudio.sln /restore -property:Configuration=Release /v:m
 
       - name: Create branch and force push
-        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7
         with:
           commit_message: Update Local TPN Files
           commit_user_name: ${{ github.actor }}