From e4c6bd9fa15a456aaf8d8571fe684fec19fad569 Mon Sep 17 00:00:00 2001
From: Stephanie Ginovker <40722898+sginovker@users.noreply.github.com>
Date: Wed, 8 Apr 2026 13:56:04 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs and update dependabot
 config

---
 .github/dependabot.yml      | 13 +++++++++++++
 .github/workflows/build.yml |  6 +++---
 2 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..8518bf5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  commit-message:
+    prefix: "[bot] "
+  cooldown:
+    default-days: 7
+  schedule:
+    interval: "weekly"
+    day: "wednesday"
+    time: "11:00"
+    timezone: "America/Los_Angeles"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3a3874d..19f8ae5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,8 +14,8 @@ jobs:
     outputs:
       version: ${{ steps.filter.outputs.version }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: dorny/paths-filter@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
         id: filter
         with:
           filters: |
@@ -32,7 +32,7 @@ jobs:
       packages: write
       contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Publish to Github Packages Registry
         run: |
           mkdir -p $HOME/.gem