ci: pin GitHub Actions and add a 7-day Dependabot cooldown (#1408)

GitHub Actions currently use mutable version tags, so retargeting a tag
can change the code executed by workflows. Pin all 11 action references
across four workflows to full commit SHAs resolved from their existing
tags, retaining version comments.


[https://aka.ms/pinning-requirement](https://docs.opensource.microsoft.com/announcements/2026-08-07-github-actions-commit-pinning/)

Add Dependabot configuration for GitHub Actions with weekly checks,
grouped updates, and a 7-day cooldown before proposing new releases.
This provides time for compromised releases to be detected before
version updates are proposed.

Validation: verified SHA mappings using the GitHub API; YAML validation
and `git diff --cached --check` passed. `uv run --no-sync pytest
tests/cli/test_main.py --no-cov -q`: 29 passed, 1 skipped because the
OpenVINO EP is unavailable.

Author: timenick

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -25,16 +25,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           languages: python
           queries: security-extended,security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4

.github/workflows/docs.yml

@@ -20,11 +20,11 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@v3
+      - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
         with:
           python-version: "3.11"
 

.github/workflows/lint.yml

@@ -18,10 +18,10 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
 
       - name: Set up Python
         run: uv python install 3.11

.github/workflows/modelkit-ci.yml

@@ -40,10 +40,10 @@ jobs:
     name: test (${{ matrix.group }})
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
         with:
           enable-cache: true
           cache-dependency-glob: pyproject.toml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Set up Node.js
         if: matrix.group == 'remaining'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22