From ef9215479f6c91ee4bf720e5dd32236cb365ebb6 Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Fri, 7 Aug 2026 05:47:16 +0000
Subject: [PATCH] ci: pin governance workflow dependencies

---
 .github/dependabot.yml        | 11 +++++++++++
 .github/workflows/check.yml   |  4 ++--
 .github/workflows/publish.yml |  4 ++--
 .github/workflows/release.yml |  2 +-
 .gitignore                    |  1 +
 5 files changed, 17 insertions(+), 5 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .gitignore

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3b031b6
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ef37b4f..a058323 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -14,9 +14,9 @@ permissions:
 jobs:
   policy:
     name: Policy validation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Validate JSON
         run: find config -name '*.json' -print0 | xargs -0 -n1 jq empty
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cda4d4d..013d2bc 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,9 +8,9 @@ permissions:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Apply organization governance and security policy
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f17290b..c73131a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
       - name: Analyze commits and publish
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..84c048a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/build/