From 9f3b84cd0b4a563741ba943f103d812fc52107e3 Mon Sep 17 00:00:00 2001
From: John Ajera <37360952+jajera@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:39:00 +1200
Subject: [PATCH] chore: replace floating checkout@v4 with reusables or sha
 pins

Point static Pages and validate-devschema workflows at actionsforge
reusables when applicable; otherwise SHA-pin checkout and sibling
actions in the same workflow files. Add Dependabot for github-actions.
---
 .github/dependabot.yml                | 10 ++++++++++
 .github/workflows/build-image.yml     | 10 +++++-----
 .github/workflows/dockerfile-lint.yml |  6 +++---
 3 files changed, 18 insertions(+), 8 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3d804fc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore"
+      include: "scope"
diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 53f6420..2680d0d 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -34,21 +34,21 @@ jobs:
       - name: Initiating process
         run: |
           echo "Building image for ${{ github.event.inputs.image }}"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           version: latest
       - name: Docker login to ghcr.io
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker build and push
-        uses: docker/build-push-action@v5.0.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ./${{ github.event.inputs.image }}
           push: true
diff --git a/.github/workflows/dockerfile-lint.yml b/.github/workflows/dockerfile-lint.yml
index 0d1c8ae..47d548a 100644
--- a/.github/workflows/dockerfile-lint.yml
+++ b/.github/workflows/dockerfile-lint.yml
@@ -16,7 +16,7 @@ jobs:
     outputs:
       matrix-dockerfiles: ${{ steps.matrix.outputs.dockerfiles }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: matrix
         run: |
           dockerfiles_raw=$(ls **/Dockerfile)
@@ -41,7 +41,7 @@ jobs:
           echo "Dockerfile: ${{ matrix.file }}"
           os=$(echo "${{ matrix.file }}" | cut -d '/' -f 1)
           echo "os=$os" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run Dockerfile Linting
         run: |
           if [ -f "./.hadolint.yaml" ]; then
@@ -51,7 +51,7 @@ jobs:
           fi
         continue-on-error: true
       - name: Upload Dockerfile Linting Report
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docker-lint-report.txt
           path: ./docker-lint-report.txt