Pin GitHub Actions to SHAs and add Dependabot

[externl]

Pins every third-party GitHub Action to a full commit SHA (with the version in a trailing comment) and adds a Dependabot config to keep those pins current, matching the setup used across the other repos.

• Pins all actions in the workflows so a moved tag can't change what CI runs.
• Adds a github-actions Dependabot block: monthly schedule, 7-day cooldown, and a single catch-all group so updates arrive as one PR.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Pins third-party GitHub Actions to commit SHAs for supply-chain safety and adds a Dependabot configuration to keep those pins updated.

Changes:

• Pinned all uses: references in the CI workflow to full commit SHAs with version comments.
• Added a Dependabot config for github-actions updates with grouping.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/ci.yml	Replaces floating action tags with full commit SHAs + version comments.
.github/dependabot.yml	Introduces Dependabot updates for GitHub Actions with a grouped update strategy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[externl]

cooldown is a supported Dependabot key — it's in the options reference (default-days, semver-major-days, etc.). It's a relatively recent addition, so it likely postdates the schema this review was checked against. The config parses and runs fine — Dependabot is already opening grouped PRs across this org using the same setup, so no change is needed here.