No one from us goes and updates pinned vcpkg commit SHA, until something breaks, let alone on a monthly basis.
But ideally we would be updating the SHA at least once a month. If some customers consume the SDK this way - why in July'23 give them packages from November'22?
Let's say we agree on updating once a month, but then if a person gets assigned to do it, it really sounds like a recurring build job that should be automated.
So I propose us to have a monthly scheduled run, say, on 20th of every month, that grabs the latest commit SHA from https://github.com/microsoft/vcpkg/commits/master, updates

, and , and creates a PR for us to merge, similar to "Increment version" PRs (example: #4687).

cc @LarryOsterman