From 428d9d2c5d13ad30b369890a523f40eb13054305 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Tue, 18 Mar 2025 16:52:28 +0900
Subject: [PATCH] ci: Pinning third party GitHub Actions sha

---
 .github/dependabot.yaml             | 5 +++++
 .github/workflows/build-debug.yml   | 2 +-
 .github/workflows/build-release.yml | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 00aea0a7..63b36f3d 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -5,3 +5,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly" # Check for updates to GitHub Actions every week
+    ignore:
+      # I just want update action when major/minor version is updated. patch updates are too noisy.
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-patch
diff --git a/.github/workflows/build-debug.yml b/.github/workflows/build-debug.yml
index 3af6348f..d226d885 100644
--- a/.github/workflows/build-debug.yml
+++ b/.github/workflows/build-debug.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
       - run: dotnet build -c Debug
       - run: dotnet test -c Debug --no-build
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 35f8662f..8fd2b906 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
       - run: dotnet build -c Release -p:Version=${{ inputs.tag }}
       - run: dotnet test -c Release --no-build