Merge pull request #840 from pllim/action-ver-hash

MNT: Use hash for Action workflow versions and update, and add dependabot, if needed
spacetelescope · Oct 1, 2024 · 7f6b545 · 7f6b545
2 parents c87ee60 + 21521f7
commit 7f6b545
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -6,3 +6,11 @@ updates:
     interval: daily
     time: "10:00"
   open-pull-requests-limit: 10
+- package-ecosystem: "github-actions"
+  directory: ".github/workflows" # Location of package manifests
+  schedule:
+    interval: "monthly"
+  groups:
+    actions:
+      patterns:
+        - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -43,11 +43,11 @@ jobs:
         run: |
           sudo apt-get install pandoc
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
         with:
           fetch-depth: 0
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3  # v5.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Upgrade pip