Add a workflow vulnerability scanner

.github/dependabot.yml

@@ -4,3 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/benchmark-impl.yml

@@ -58,20 +58,20 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false
       - name: Set up python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Set up poetry
-        uses: hpcflow/github-support/setup-poetry@0.5
+        uses: $/setup-poetry
         with:
           version: ${{ inputs.poetry-version }}
       - name: Cache dependencies
-        uses: hpcflow/github-support/init-cache@0.5
+        uses: $/init-cache
         with:
           name: benchmark
           version: ${{ matrix.python-version }}
@@ -83,12 +83,15 @@ jobs:
       - name: Set up variables
         id: vars
         run: |
-          echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
+          echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
         shell: bash
+        env:
+          N_ELEMS: ${{ matrix.num_elements }}
+          PY_VER: ${{ matrix.python-version }}
 
       - name: Run app make workflow command
         run: |
-          poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
+          poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
         env:
           EXECUTABLE: ${{ inputs.executable_name }}
           BENCHMARK: ${{ inputs.benchmark_make_workflow }}
@@ -97,7 +100,7 @@ jobs:
         shell: bash
 
       - name: Store benchmark file
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.vars.outputs.timeit }}
           path: ${{ steps.vars.outputs.timeit }}
@@ -113,17 +116,17 @@ jobs:
         run: |
           mkdir benchmarks
       - name: Fetch benchmark data
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true
           path: benchmarks
       - name: Delete partial benchmark data
-        uses: geekyeggo/delete-artifact@v6
+        uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
         with:
           name: "*"
           failOnError: false
       - name: Store benchmark data archive
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: upload
         with:
           name: benchmarks