From 5dbbf34f58ea2d4076ac2acd871d1577605eccb3 Mon Sep 17 00:00:00 2001
From: Piotr Grabowski <piotr@quesma.com>
Date: Thu, 22 Oct 2026 15:21:29 +0200
Subject: [PATCH 1/2] ci: pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml              | 9 +++++++++
 .github/workflows/build-app.yml     | 6 +++---
 .github/workflows/build-toolbox.yml | 8 ++++----
 3 files changed, 16 insertions(+), 7 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2dedc4d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/build-app.yml b/.github/workflows/build-app.yml
index f088690..e13c9d7 100644
--- a/.github/workflows/build-app.yml
+++ b/.github/workflows/build-app.yml
@@ -31,7 +31,7 @@ jobs:
             arch: arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Recreate .fk1.txt and .fk2.txt
         shell: bash
@@ -45,7 +45,7 @@ jobs:
           if [ -n "${FK2_TXT_B64:-}" ]; then printf "%s" "$FK2_TXT_B64" | openssl base64 -d -A > app/.fk2.txt; fi
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -62,7 +62,7 @@ jobs:
           GOFLAGS="-trimpath" go build -ldflags="-s -w" -o dist/gradient-engineer.${{ matrix.os }}.${{ matrix.arch }} ./app
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: gradient-engineer.${{ matrix.os }}.${{ matrix.arch }}
           path: dist/gradient-engineer.${{ matrix.os }}.${{ matrix.arch }}
diff --git a/.github/workflows/build-toolbox.yml b/.github/workflows/build-toolbox.yml
index 18da36e..f464a15 100644
--- a/.github/workflows/build-toolbox.yml
+++ b/.github/workflows/build-toolbox.yml
@@ -31,17 +31,17 @@ jobs:
             arch: arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           check-latest: true
           cache: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v31
+        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
 
       - name: Build toolbox builder
         shell: bash
@@ -67,7 +67,7 @@ jobs:
           ./toolbox-builder --playbook ../playbook/60-second-darwin.yaml --out .
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: toolbox.${{ matrix.os }}.${{ matrix.arch }}
           path: toolbox/*.tar.xz

From bcbbb4b7f8292bb6460d46b9cafc9b669811efcf Mon Sep 17 00:00:00 2001
From: Piotr Grabowski <piotr@quesma.com>
Date: Thu, 22 Oct 2026 16:02:57 +0200
Subject: [PATCH 2/2] ci: wait 7 days before Dependabot proposes new action
 versions

---
 .github/dependabot.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2dedc4d..c342639 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns: ["*"]