Hash pin Actions and enable dependabot (#228)

* Update ci.yml * Update lock.yml * Create dependabot.yml

Author: joycebrum

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+ - package-ecosystem: "github-actions" # Necessary to update action hashes
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ # Allow up to 3 opened pull requests for github-actions versions
+ open-pull-requests-limit: 3

.github/workflows/ci.yml

@@ -13,9 +13,9 @@ jobs:
  runs-on: ubuntu-20.04
 
  steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  - name: Set up Python
- uses: actions/setup-python@v4
+ uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4.6.1
  - name: Install dependencies
  run: pip install mypy
  - name: Run mypy
@@ -34,9 +34,9 @@ jobs:
  - "3.11"
  - "3.12-dev"
  steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  - name: Set up Python ${{ matrix.python-version }}
- uses: actions/setup-python@v4
+ uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4.6.1
  with:
  python-version: ${{ matrix.python-version }}
  - name: Install test dependencies

.github/workflows/lock.yml

@@ -13,7 +13,7 @@ jobs:
  permissions:
  issues: write
  steps:
- - uses: dessant/lock-threads@v3
+ - uses: dessant/lock-threads@e460dfeb36e731f3aeb214be6b0c9a9d9a67eda6 # v3.0.0
  with:
  github-token: ${{ secrets.GITHUB_TOKEN }}
  issue-inactive-days: 90