From 778f8ae7ba7f8e9f90e4e06c6411840bca1a4bef Mon Sep 17 00:00:00 2001 From: Oliver Kopp Date: Sat, 10 Oct 2026 15:48:58 +0200 Subject: [PATCH] Add Dependabot and pin GitHub Actions to commit SHAs Dependabot now checks GitHub Actions, Maven, Gradle (IntelliJ plugin) and npm (VS Code extension) weekly, with updates grouped per ecosystem. All actions in the CI and release workflows are updated to their latest releases and pinned to full commit SHAs with a version comment, so Dependabot can keep them current. CI now runs with read-only contents permission. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 37 +++++++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 25 ++++++++++++----------- .github/workflows/release.yml | 22 ++++++++++----------- 3 files changed, 62 insertions(+), 22 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..3a3306d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,37 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: + - "*" + + - package-ecosystem: maven + directory: / + schedule: + interval: weekly + groups: + maven: + patterns: + - "*" + + - package-ecosystem: gradle + directory: /intellij-plugin + schedule: + interval: weekly + groups: + gradle: + patterns: + - "*" + + - package-ecosystem: npm + directory: /vscode-extension + schedule: + interval: weekly + groups: + npm: + patterns: + - "*" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8d00560..e107cdf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,15 +5,18 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: server: name: Build and test server runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -24,7 +27,7 @@ jobs: - name: Upload test reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: surefire-reports path: target/surefire-reports/ @@ -35,10 +38,10 @@ jobs: runs-on: ubuntu-latest needs: server steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -48,7 +51,7 @@ jobs: run: mvn --batch-mode -DskipTests package - name: Set up JDK for Gradle - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -59,7 +62,7 @@ jobs: run: ./gradlew buildPlugin --no-daemon - name: Upload plugin package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: intellij-plugin path: intellij-plugin/build/distributions/*.zip @@ -83,10 +86,10 @@ jobs: - os: macos-latest target: darwin-arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -96,7 +99,7 @@ jobs: run: mvn --batch-mode -DskipTests package - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '24' @@ -107,7 +110,7 @@ jobs: npm run package -- ${{ matrix.target }} - name: Upload extension package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: vscode-extension-${{ matrix.target }} path: vscode-extension/*.vsix diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4016229..18b8cdd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,17 +30,17 @@ jobs: target: darwin-arm64 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Fail if not running on main branch if: ${{ github.ref != 'refs/heads/main' }} - uses: actions/github-script@v7 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | core.setFailed('This workflow must run on main. Current ref: ${{ github.ref }}') - name: Set up JDK 17 for Maven - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -50,7 +50,7 @@ jobs: run: mvn --batch-mode -DskipTests package - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '24' @@ -62,7 +62,7 @@ jobs: npm run package -- ${{ matrix.target }} - name: Upload extension package - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: vscode-extension-${{ matrix.target }} path: vscode-extension/*.vsix @@ -78,17 +78,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Fail if not running on main branch if: ${{ github.ref != 'refs/heads/main' }} - uses: actions/github-script@v7 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | core.setFailed('This workflow must run on main. Current ref: ${{ github.ref }}') - name: Set up JDK 17 for Maven - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -98,7 +98,7 @@ jobs: run: mvn --batch-mode -DskipTests package - name: Set up JDK 17 for Gradle - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: '17' @@ -109,7 +109,7 @@ jobs: run: ./gradlew buildPlugin --no-daemon - name: Download platform-specific extension packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: vscode-extension-* path: vscode-extension @@ -122,7 +122,7 @@ jobs: - name: Set up Node.js if: ${{ env.OVSX_PAT != '' }} - uses: actions/setup-node@v4 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '24'