[WIP] Fix GitHub Actions job by pinning action versions

[Copilot]

Fix GitHub Actions Policy Violation - Pin Actions to Full SHA

Změny

• Aktualizace .github/workflows/ci.yaml - pinování actions na plné SHA
  • actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 (v4.3.1)
  • oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 (v2.1.2)
• Vytvoření .github/dependabot.yml - týdenní automatické aktualizace

Kontext

• Opravuje failing job #62316095653
• Target branch: sync/bun-migration
• GitHub Actions policy vyžaduje plné commit SHA místo tagů

Po aplikaci změn

✅ CI workflow projde policy checkem
✅ Dependabot bude automaticky kontrolovat aktualizace actions
✅ Týdenně budou vytvářeny PR s novými verzemi SHA

Original prompt

Create a PR against branch sync/bun-migration to fix failing GitHub Actions job 62316095653 in SQLoot/evolu-plan-b PR #5.

Failure:

• GitHub Actions policy requires all actions to be pinned to a full-length commit SHA.
• Workflow currently uses tag refs:
  • actions/checkout@v4
  • oven-sh/setup-bun@v2

Relevant workflow file (at ref c8f6e3d):

• .github/workflows/ci.yaml
  • Replace the above action uses with full-length commit SHA pins.
  • Prefer to include a comment with the human-readable version tag next to the SHA (optional but nice).

Additionally implement the "compromise" approach:

• Add automation to keep pinned action SHAs up to date automatically.
• Use Dependabot (preferred) to update GitHub Actions versions regularly.
  • Add .github/dependabot.yml configured for package-ecosystem: "github-actions" at / and a reasonable schedule (e.g., weekly).

Acceptance criteria:

• CI workflow passes the policy check (no unpinned actions).
• Dependabot is configured to create PRs updating pinned action SHAs.
• Keep changes minimal and scoped.

References:

• Failing job id: 62316095653
• PR: PR: Migration common-v8 to biome and bun #5
• Workflow: .github/workflows/ci.yaml at ref c8f6e3dbc0ecf027ca5f1a42db349c287eb2eabb

Links:

• Workflow file: https://github.com/SQLoot/evolu-plan-b/blob/c8f6e3dbc0ecf027ca5f1a42db349c287eb2eabb/.github/workflows/ci.yaml

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}