fix: pin GitHub Actions to commit SHA, add dependabot config

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      all-composer:
+        patterns: ["*"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      all-actions:
+        patterns: ["*"]

.github/workflows/benchmark-comment.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Download benchmark result
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: benchmark-result
           run-id: ${{ github.event.workflow_run.id }}
@@ -33,15 +33,15 @@ jobs:
           echo "<sub>To run a specific benchmark, comment <code>/benchmark &lt;name&gt;</code><br><code>attributes</code>, <code>aware</code>, <code>class</code>, <code>default</code>, <code>forwarding</code>, <code>merge</code>, <code>named-slots</code>, <code>no-attributes</code>, <code>slot</code>, <code>compilation</code></sub>" >> benchmark-comment.md
 
       - name: Find existing comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3
         id: find
         with:
           issue-number: ${{ steps.meta.outputs.number }}
           comment-author: 'github-actions[bot]'
           body-includes: '${{ steps.meta.outputs.heading }}'
 
       - name: Post or update comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         with:
           issue-number: ${{ steps.meta.outputs.number }}
           comment-id: ${{ steps.find.outputs.comment-id }}

.github/workflows/benchmark-on-demand.yml

@@ -26,12 +26,12 @@ jobs:
           echo "benchmark=$BENCHMARK" >> "$GITHUB_OUTPUT"
 
       - name: Checkout base branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           tools: composer:v2
@@ -48,7 +48,7 @@ jobs:
         run: cp benchmark-snapshot.json ${{ runner.temp }}/benchmark-snapshot.json
 
       - name: Checkout PR
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: refs/pull/${{ github.event.issue.number }}/head
 
@@ -64,7 +64,7 @@ jobs:
           vendor/bin/testbench benchmark ${{ steps.input.outputs.benchmark }} --ci --iterations=5000 --rounds=10 --attempts=10 >> benchmark-result.md
 
       - name: Upload benchmark result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: benchmark-result
           path: benchmark-result.md

.github/workflows/ci.yml

@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php }}
           tools: composer:v2
@@ -36,7 +36,7 @@ jobs:
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -61,12 +61,12 @@ jobs:
 
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           tools: composer:v2
@@ -83,7 +83,7 @@ jobs:
         run: cp benchmark-snapshot.json ${{ runner.temp }}/benchmark-snapshot.json
 
       - name: Checkout PR
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install PR dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
@@ -97,7 +97,7 @@ jobs:
           vendor/bin/testbench benchmark default --ci --iterations=5000 --rounds=10 --attempts=10 >> benchmark-result.md
 
       - name: Upload benchmark result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: benchmark-result
           path: benchmark-result.md