From fb010c3fc3f11567435b48c0c63e421db13d978f Mon Sep 17 00:00:00 2001
From: Thomas Waldmann <tw@waldmann-edv.de>
Date: Mon, 31 Aug 2026 22:24:06 +0200
Subject: [PATCH] CI: harden the workflows, add dependabot

zizmor (auditor persona) findings on .github/workflows/:

- unpinned-uses: pin actions/checkout and actions/setup-python to their
  full commit hash, with the version as a comment - same pins borg uses.
  A moved tag can not silently change what runs in CI anymore.
- excessive-permissions: give the CI workflow "permissions: contents:
  read" instead of whatever the repository default is.
- artipacked: "persist-credentials: false" for the checkouts, so the
  GITHUB_TOKEN does not end up in .git/config for the rest of the job.
  Neither workflow pushes; the release workflow passes github.token to
  gh explicitly.
- concurrency-limits: superseded CI runs of a PR are cancelled now. The
  release workflow gets a concurrency group that never cancels - it
  queues a second push of the same tag instead.
- anonymous-definition: name the CI job.

Pinning to hashes needs something to move the pins, so add a dependabot
config modelled on borg's: grouped weekly updates for the actions and
for requirements.d, with the same cooldown so brand new releases are not
picked up immediately.
---
 .github/dependabot.yml        | 28 ++++++++++++++++++++++++++++
 .github/workflows/ci.yml      | 13 +++++++++++--
 .github/workflows/release.yml |  6 ++++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2a0e661
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      # default-days also covers patch releases and actions not using semver.
+      default-days: 14
+      semver-minor-days: 30
+      semver-major-days: 90
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "pip"
+    directory: "/requirements.d"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      # default-days also covers patch releases and packages not using semver.
+      default-days: 14
+      semver-minor-days: 30
+      semver-major-days: 90
+    groups:
+      pip-dependencies:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eab0252..804f5b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,8 +24,16 @@ on:
     - '**.ini'
     - 'requirements.d/*'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
 jobs:
   linux:
+    name: Linux, Python ${{ matrix.python-version }}
 
     strategy:
       fail-fast: true
@@ -51,12 +59,13 @@ jobs:
     continue-on-error: ${{ matrix.allow-failure || false }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         # just fetching 1 commit is not enough for setuptools-scm, so we fetch all
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install Python requirements
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 07cdb0c..9cb6a03 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,11 @@ on:
     tags:
     - '*.*.*'
 
+concurrency:
+  # Never cancel a release run: queue a second push of the same tag instead.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -45,6 +50,7 @@ jobs:
         # Just fetching one commit is not enough for setuptools-scm, so we fetch all.
         fetch-depth: 0
         fetch-tags: true
+        persist-credentials: false
 
     - name: Set up Python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0