From c7a793d71af708e0af9859853dc5c9815e601913 Mon Sep 17 00:00:00 2001
From: Diogo Teles Sant'Anna <diogoteles@google.com>
Date: Mon, 1 Jan 2024 19:00:05 -0300
Subject: [PATCH] CI: hash-pin sensitive workflow and configure dependabot to
 keep them updated (#329)

---
 .github/dependabot.yml               | 10 ++++++++++
 .github/workflows/bzlmod-archive.yml |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2390d8c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/bzlmod-archive.yml b/.github/workflows/bzlmod-archive.yml
index 0c117ff..a6b5e78 100644
--- a/.github/workflows/bzlmod-archive.yml
+++ b/.github/workflows/bzlmod-archive.yml
@@ -12,7 +12,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: git archive -o "${{ format('{0}-{1}.tar.gz', github.event.repository.name, github.event.release.tag_name) }}" HEAD
       - run: gh release upload ${{ github.event.release.tag_name }} *.tar.gz
         env: