From 175f7adc6218b84b52ca94248bb5e14095fd70e6 Mon Sep 17 00:00:00 2001
From: Alexander Rashed <alexander.rashed@localstack.cloud>
Date: Mon, 31 Aug 2026 09:13:57 +0000
Subject: [PATCH] ci: update GitHub actions, pin to SHAs, add dependabot

Update all actions to their latest releases and pin them to commit SHAs
with a trailing version comment:

  actions/checkout              v4          -> v7.0.1
  actions/setup-python          v5          -> v7.0.0
  pypa/gh-action-pypi-publish   release/v1  -> v1.14.2
  sphinx-notes/pages            v3          -> 3.6

pypa/gh-action-pypi-publish was tracking a mutable branch, so its
contents could change without any change here.

Add a dependabot config for the github-actions ecosystem (weekly, all
actions grouped into a single PR) to keep the pins current.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml             | 12 ++++++++++++
 .github/workflows/build.yml        | 10 +++++-----
 .github/workflows/docs-publish.yml |  2 +-
 3 files changed, 18 insertions(+), 6 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..80b0b3e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6f0e4e7..ae63823 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,11 +24,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -59,12 +59,12 @@ jobs:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
@@ -75,4 +75,4 @@ jobs:
         run: ls -lah dist/
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml
index d8a3cce..7509449 100644
--- a/.github/workflows/docs-publish.yml
+++ b/.github/workflows/docs-publish.yml
@@ -15,4 +15,4 @@ jobs:
       id-token: write
     steps:
     - id: deployment
-      uses: sphinx-notes/pages@v3
+      uses: sphinx-notes/pages@6e3e0108e79636a0908b1c2c5899e0d3dfad0bc1 # 3.6