Use Dependabot to update local composite actions

The 'directory: /' configuration only looks at workflows.

Author: cbandy

.github/actions/trivy/action.yaml

@@ -54,7 +54,7 @@ runs:
 
     # Install Trivy as requested.
     - if: ${{ ! contains(fromJSON(steps.parsed.outputs.setup), 'none') }}
-      uses: aquasecurity/[email protected].2
+      uses: aquasecurity/[email protected].3
       with:
         cache: ${{ contains(fromJSON(steps.parsed.outputs.setup), 'cache') }}
         version: ${{ steps.parsed.outputs.version }}

.github/dependabot.yml

@@ -1,13 +1,17 @@
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates
+# Copyright 2024 - 2025 Crunchy Data Solutions, Inc.
 #
-# See: https://www.github.com/dependabot/dependabot-core/issues/4605
----
+# SPDX-License-Identifier: Apache-2.0
+#
+# documentation: https://docs.github.com/code-security/dependabot/dependabot-version-updates
+# schema documentation: https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 # yaml-language-server: $schema=https://json.schemastore.org/dependabot-2.0.json
+---
 version: 2
 updates:
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - '/'
+      - '.github/actions/*'
     schedule:
       interval: weekly
       day: tuesday

.github/workflows/lint.yaml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/setup-go@v5
         with: { go-version: stable }
 
-      - uses: golangci/golangci-lint-action@v7
+      - uses: golangci/golangci-lint-action@v8
         with:
           version: latest
           args: --timeout=5m