chore: remove leftovers, pin actions

.dockerignore

@@ -0,0 +1,23 @@
+# Only send what the docs image build needs to the build context (allow
+# list): the workspaces, the build scripts and the root manifests read by
+# `turbo prune`. Everything else, such as `.env*` files with secrets, never
+# reaches the image
+*
+!apps/
+!packages/
+!scripts/
+!package.json
+!package-lock.json
+!turbo.json
+
+# Exclude local files within the included paths: environment files (except
+# examples), dependencies and build output (rebuilt in the image)
+**/.env*
+!**/.env.example
+**/node_modules
+**/.next
+**/.turbo
+**/.vercel
+**/coverage
+**/dist
+**/out

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  # Actions in the workflows are pinned to commit SHAs; this keeps the pins
+  # (and their version comments) up to date, in one grouped pull request
+  - package-ecosystem: github-actions
+    directory: /
+    # Pull request titles must be Conventional Commits (PR title check)
+    commit-message:
+      prefix: ci
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/pr_evaluation.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.action != 'edited' || github.event.changes.title != null }}
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: semantic_pr
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: List files with merge conflict markers
         run: git --no-pager grep "<<<<<<<" ":(exclude).github/" || true
       - name: Fail or succeed job if any files with merge conflict markers have been checked in
@@ -61,27 +61,15 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
       - name: Use Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
-
-      - name: Get node version
-        id: node
-        run: |
-          echo "::set-output name=version::$(node -v)"
-
-      - name: Get node_modules cache
-        uses: actions/cache@v4
-        id: node_modules
-        with:
-          path: |
-            **/node_modules
-          key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }}
+          cache: npm
 
       - name: Install dependencies
         run: npm install
@@ -91,39 +79,29 @@ jobs:
 
   tests:
     name: Test checks
-    runs-on: ubuntu-latest
+    # Playwright 1.56 can't install its browsers on Ubuntu 26.04, which
+    # `ubuntu-latest` now is; move on when Playwright is upgraded
+    runs-on: ubuntu-24.04
     needs: semantic_pr
     strategy:
       matrix:
         node-version: [18.x, 20.x]
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
-
-      - name: Get node version
-        id: node
-        run: |
-          echo "::set-output name=version::$(node -v)"
-
-      - name: Get node_modules cache
-        uses: actions/cache@v4
-        id: node_modules
-        with:
-          path: |
-            **/node_modules
-          key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }}
+          cache: npm
 
       - name: Cache Playwright
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cache/ms-playwright

.github/workflows/publish.yml

@@ -13,27 +13,17 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
       - name: Use Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
-
-      - name: Get node version
-        id: node
-        run: |
-          echo "::set-output name=version::$(node -v)"
-
-      - name: Get node_modules cache
-        uses: actions/cache@v4
-        id: node_modules
-        with:
-          path: |
-            **/node_modules
-          key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }}
+          # No dependency cache in releases (cache poisoning); `package.json`
+          # sets `packageManager`, which would turn on npm caching by default
+          package-manager-cache: false
 
       - name: Install dependencies
         run: npm install
@@ -89,7 +79,7 @@ jobs:
     needs:
       - linters
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set env
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
       - name: Remove 'v' from RELEASE_VERSION
@@ -99,12 +89,12 @@ jobs:
           echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
         shell: bash
       - name: Install SSH Client
-        uses: webfactory/ssh-agent@v0.7.0
+        uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
@@ -114,9 +104,11 @@ jobs:
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
+          # No dependency cache in releases, see above
+          package-manager-cache: false
 
       - name: Install dependencies
         run: npm ci
@@ -183,9 +175,8 @@ jobs:
           git commit -m "bump: v$RELEASE_VERSION"
 
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0
         with:
-          force-with-lease: true
           ssh: true
           branch: main
 
@@ -195,7 +186,7 @@ jobs:
     needs: bump-monorepo
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
@@ -210,9 +201,11 @@ jobs:
         shell: bash
 
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.x
+          # No dependency cache in releases, see above
+          package-manager-cache: false
 
       - name: Login to npm
         run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc