From f12f3cf9f00f3ed252e359350bb48d25f0c5c15c Mon Sep 17 00:00:00 2001 From: nicodes Date: Sat, 1 Aug 2026 19:28:09 -0600 Subject: [PATCH] Watch the action pins with dependabot Every third-party `uses:` in this repository is pinned to a commit SHA rather than a tag, because a tag is a moving reference and whoever can move it can run code in these jobs. The cost of a SHA is that nothing tells you when it has gone stale -- a tag at least reads as a version. This is the thing that tells you. Grouped into one pull request rather than one per action: these are all the same kind of change, and a pin bump arriving alone every few days is how pin bumps stop being read at all. Scoped to github-actions. The aviorstudio/* and nicodes/* refs stay on version tags by decision, so dependabot will offer those as version bumps rather than opaque SHA changes. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..89a723c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,25 @@ +# Keeps the pinned `uses:` refs in .github/workflows and .github/actions current. +# +# Every third-party action here is pinned to a commit SHA rather than a tag, +# which is the point: a tag is a moving reference, and whoever can move it can +# run code in these jobs. The cost of a SHA is that nothing tells you when it +# has gone stale -- a tag at least reads as a version. This is the thing that +# tells you. +# +# Grouped into one pull request rather than one per action. These are all the +# same kind of change, and a pin bump arriving alone every few days is how pin +# bumps stop being read at all. +# +# Scoped to github-actions. The aviorstudio/* and nicodes/* refs stay on version +# tags by decision, and dependabot will offer those as version bumps rather than +# opaque SHA changes. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + patterns: + - "*"