Merge pull request #40 from marko-bekhta/gh-hash

Enable GitHub actions dependency updates / Use SHA instead of versions in GH actions
hibernate · Feb 5, 2025 · d38f291 · d38f291
2 parents eb06f2e + 9d000e1
commit d38f291
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -10,3 +10,14 @@ updates:
           - "*maven*plugin*"
           - "*plexus*"
           - "org.apache.maven*:*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      workflow-actions:
+        patterns:
+          - "*"
+    allow:
+      - dependency-name: "actions/*"
+      - dependency-name: "redhat-actions/*"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -22,10 +22,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:
         distribution: temurin
         java-version: 17