From a563fe285706bca3791f188abd7331f1c8488888 Mon Sep 17 00:00:00 2001
From: Stephanie Ginovker <40722898+sginovker@users.noreply.github.com>
Date: Wed, 8 Apr 2026 18:05:31 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs and update dependabot
 config

---
 .github/dependabot.yml               | 13 +++++++++++++
 .github/workflows/python-package.yml |  4 ++--
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..8518bf5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  commit-message:
+    prefix: "[bot] "
+  cooldown:
+    default-days: 7
+  schedule:
+    interval: "weekly"
+    day: "wednesday"
+    time: "11:00"
+    timezone: "America/Los_Angeles"
diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 8a7fbf7..ac3905c 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -14,9 +14,9 @@ jobs:
         python-version: ["3.10"]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies