From 1e4df97729004e58b9e41afb324f9cebf3b91aa1 Mon Sep 17 00:00:00 2001
From: Ancelin SERRE <ancelin.serre@protonmail.com>
Date: Thu, 29 Oct 2026 17:47:51 +0100
Subject: [PATCH] ci: pin the workflows' actions to commit SHAs and update them
 with Dependabot

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml      |  9 +++++++++
 .github/workflows/ci.yml    |  4 ++--
 .github/workflows/image.yml | 18 +++++++++---------
 3 files changed, 20 insertions(+), 11 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..fecd44d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e75585e..5481ba4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,8 +12,8 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: jdx/mise-action@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
       - run: mise run check
       - name: Audit locked dependencies
         run: uv export --frozen --no-emit-project -o /tmp/requirements.txt && uvx pip-audit --disable-pip --no-deps -r /tmp/requirements.txt
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 4fa678b..287abcd 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -18,21 +18,21 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         if: github.ref_type == 'tag'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.IMAGE }}
       - name: Build both architectures
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         id: build
         with:
           context: .
@@ -46,14 +46,14 @@ jobs:
       # One archive per architecture, with gzip layers: its size is the size a
       # registry stores. The layers come from the build cache of the step above.
       - name: Export the amd64 image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: linux/amd64
           outputs: type=oci,dest=amd64.tar,compression=gzip
           cache-from: type=gha
       - name: Export the arm64 image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           platforms: linux/arm64
@@ -67,7 +67,7 @@ jobs:
             echo "$platform: $size bytes compressed"
             [ "$size" -le "$MAX_COMPRESSED_BYTES" ] || { echo "$platform exceeds 600 MB"; exit 1; }
           done
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         if: github.ref_type == 'tag'
         with:
           subject-name: ${{ env.IMAGE }}