From 1e12d4a186ad851badc6b8c3bab0788fecf4f932 Mon Sep 17 00:00:00 2001
From: Leo-Paul Hauet <leo-paul.hauet@tryriot.com>
Date: Wed, 9 Sep 2026 14:06:09 +0200
Subject: [PATCH] chore(ci): pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml       | 12 ++++++++++++
 .github/workflows/elixir.yml |  6 +++---
 2 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a958799
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  # SHA-pinned actions do not update themselves; without this the pins rot.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    # Do not adopt a release the day it ships — leave a window for a malicious
+    # or broken version to be caught first.
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml
index 360bd4a..de5ea38 100644
--- a/.github/workflows/elixir.yml
+++ b/.github/workflows/elixir.yml
@@ -19,16 +19,16 @@ jobs:
       MIX_ENV: test
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Setup Elixir
-      uses: erlef/setup-beam@v1
+      uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
       with:
         version-type: strict
         version-file: .tool-versions
 
     - name: Restore dependencies cache
-      uses: actions/cache@v3
+      uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
       with:
         path: deps
         key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}