From 6e6e8f26a13bbb545b23665c0f292526a87afee8 Mon Sep 17 00:00:00 2001
From: Tim Smith <tsmith84@proton.me>
Date: Sat, 27 Jun 2026 22:32:55 -0700
Subject: [PATCH] Pin GitHub Actions to commit SHAs and let Dependabot update
 them

The workflows referenced actions by mutable major tags, which had also
drifted out of sync (checkout was @v6 in ci.yml and @v4 in lint.yml).
A tag can be repointed at malicious code after review, so pin every
action to a full-length commit SHA (the only immutable reference) at its
current latest release, with a version comment for readability:

- actions/checkout    -> v7.0.0
- ruby/setup-ruby      -> v1.314.0
- r7kamura/rubocop-problem-matchers-action -> v1.2.2

Add a github-actions ecosystem to Dependabot so these SHAs are bumped
automatically as new releases ship, and add a 7-day cooldown to both
ecosystems so freshly published versions are not adopted immediately.

Signed-off-by: Tim Smith <tsmith84@proton.me>
---
 .github/dependabot.yml     | 9 +++++++++
 .github/workflows/ci.yml   | 4 ++--
 .github/workflows/lint.yml | 6 +++---
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 452ebb34..385efb3e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,3 +5,12 @@ updates:
   schedule:
     interval: daily
   open-pull-requests-limit: 10
+  cooldown:
+    default-days: 7
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 10
+  cooldown:
+    default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abea6695..13bda2c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,8 @@ jobs:
         ruby: [ '3.1', '3.4' ]
     name: Test with Ruby ${{ matrix.ruby }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 80f6b5ba..26c3b18c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,12 +15,12 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
         with:
           ruby-version: 3.1
           bundler-cache: false
-      - uses: r7kamura/rubocop-problem-matchers-action@v1  # this shows the failures in the PR
+      - uses: r7kamura/rubocop-problem-matchers-action@59f1a0759f50cc2649849fd850b8487594bb5a81 # v1.2.2 — shows the failures in the PR
       - run: |
           gem install cookstyle
           cookstyle --chefstyle -c .rubocop.yml