Dependabot version updates (#340)

* yamllint for newer file

* Allow for proper, lower-level, pinning

Makes for increased reproducibility (and overall control)

Author: paulo-ferraz-oliveira

.github/dependabot.yml

@@ -0,0 +1,11 @@
+---
+version: 2
+updates:
+- package-ecosystem: npm
+  directory: /
+  schedule:
+    interval: weekly
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly

.github/workflows/action.yml

@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Version it!
         run: |
           # We expect a string such as const setupBeamVersion = 'undefined' in the code
@@ -45,8 +45,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '20'
       - run: npm run build-dist
@@ -58,15 +58,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
-      - uses: raven-actions/actionlint@v2
+      - uses: actions/checkout@v4.2.2
+      - uses: raven-actions/actionlint@v2.0.1
 
   unit_tests_ubuntu:
     name: Unit tests (Ubuntu)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '20'
       - run: npm ci
@@ -83,8 +83,8 @@ jobs:
     name: Unit tests (Windows)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '20'
       - run: npm install --production
@@ -94,8 +94,8 @@ jobs:
     name: Unit tests (macOS)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '20'
       - run: npm ci

.github/workflows/hexpm-mirrors.yml

@@ -26,7 +26,7 @@ jobs:
         install-rebar: [true, false]
         install-hex: [true, false]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/macos.yml

@@ -71,7 +71,7 @@ jobs:
             rebar3-version: 'latest'
             os: 'macos-latest'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -124,7 +124,7 @@ jobs:
             rebar3-version: nightly
             os: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/ubuntu.yml

@@ -83,7 +83,7 @@ jobs:
             escript_script: 'protoc-gen-elixir --version'
             os: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -151,7 +151,7 @@ jobs:
             rebar3-version: nightly
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

.github/workflows/update_3rd_party_licenses.yml

@@ -14,7 +14,7 @@ jobs:
     name: Update 3rd party licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - run:
           ./.github/workflows/update_3rd_party_licenses.sh
         env:

.github/workflows/windows.yml

@@ -64,7 +64,7 @@ jobs:
             escript_script: 'protoc-gen-elixir --version'
             os: 'windows-latest'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./
@@ -131,7 +131,7 @@ jobs:
             rebar3-version: nightly
             os: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Use erlef/setup-beam
         id: setup-beam
         uses: ./

package.json

@@ -10,7 +10,7 @@
     "markdownlint": "markdownlint *.md ./github/**/*.md",
     "shellcheck": "shellcheck .github/workflows/*.sh",
     "test": "node --test --test-reporter=spec",
-    "yamllint": "eslint .github/workflows/**.yml .*.yml *.yml",
+    "yamllint": "eslint .github/workflows/**.yml .github/*.yml .*.yml *.yml",
     "clean-dist": "rm -rf ./dist",
     "lint": "npm run markdownlint && npm run shellcheck && npm run yamllint && npm run eslint",
     "build-dist": "npm run clean-dist && npm install && npm run build && npm run format && npm run lint"

test/projects/gleamgleam/.github/workflows/test.yml

@@ -11,7 +11,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - uses: erlef/setup-beam@v1
         with:
           otp-version: "26.0.2"