From 71aebfbdd279e6b9859599910fefb791779afae8 Mon Sep 17 00:00:00 2001
From: Colin Lambrechts <colin.lambrechts@lego.com>
Date: Thu, 2 Jul 2026 16:15:33 +0200
Subject: [PATCH] Use pinned versions for the actions we rely on.

---
 .github/dependabot.yml        | 6 ++++--
 .github/workflows/release.yml | 6 +++---
 .github/workflows/scala.yml   | 6 +++---
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8a90cca..d8aba22 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -2,6 +2,8 @@ version: 2
 
 updates:
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directory:
+      - "/" # For workflows
+      - ".github/actions/*" # For local actions
     schedule:
-      interval: "daily"
\ No newline at end of file
+      interval: "weekly"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df932eb..249df45 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,15 +8,15 @@ jobs:
     runs-on: ubuntu-22.04
     environment: Maven Central Release
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '17'
           cache: 'sbt'
-      - uses: sbt/setup-sbt@v1
+      - uses: sbt/setup-sbt@93e926cbdb4a428e41b4ef754124ec82925ffdc2 # v1.1.23
         with:
           sbt-runner-version: 1.10.2
       - run: sbt ci-release
diff --git a/.github/workflows/scala.yml b/.github/workflows/scala.yml
index fde8bd5..51de2d4 100644
--- a/.github/workflows/scala.yml
+++ b/.github/workflows/scala.yml
@@ -10,13 +10,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up JDK 16
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "16"
           distribution: "adopt"
-      - uses: sbt/setup-sbt@v1
+      - uses: sbt/setup-sbt@93e926cbdb4a428e41b4ef754124ec82925ffdc2 # v1.1.23
         with:
           sbt-runner-version: 1.10.2
       - name: Check sources formatting