Pin GitHub Actions to specific commit SHAs

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: daily
+    rebase-strategy: disabled
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+      exclude:
+        - fac/*

.github/workflows/check-pinned-actions.yml

@@ -0,0 +1,11 @@
+name: Check actions have their versions pinned
+
+on:
+  push:
+    paths:
+      - '.github/workflows/*.yml'
+      - '.github/workflows/*.yaml'
+
+jobs:
+  pinact:
+    uses: fac/shared-workflows/.github/workflows/check_pinned_actions.yml@main

.github/workflows/release.yml

@@ -11,13 +11,13 @@ jobs:
     name: Test action
 
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
         name: Checkout code
 
       - name: Run tests
         run: npm run test
 
-      - uses: pCYSl5EDgo/cat@1.0.0
+      - uses: pCYSl5EDgo/cat@264f5b318158276af69bd0a2a9f1e613b2d03ebf # 1.0.0
         name: Cat for GitHub Actions
         id: get_key
         with:
@@ -47,7 +47,7 @@ jobs:
     name: Update action
 
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
         name: Checkout code
 
       - name: Update v1 Tag

.pinact.yaml

@@ -0,0 +1,4 @@
+version: 3
+ignore_actions:
+  - name: fac/.*
+    ref: ^main$