From f97c1448325dc2f44a85367952c15928075822f1 Mon Sep 17 00:00:00 2001
From: Stephen Lang <stephen.lang@grafana.com>
Date: Mon, 28 Apr 2025 15:46:07 +0100
Subject: [PATCH 1/3] chore(ci): pinact run

---
 .github/workflows/check-with-upstream.yaml | 2 +-
 .github/workflows/ci.yaml                  | 4 ++--
 .github/workflows/release.yaml             | 2 +-
 .github/workflows/stale.yml                | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/check-with-upstream.yaml b/.github/workflows/check-with-upstream.yaml
index 6ded89178..46585e294 100644
--- a/.github/workflows/check-with-upstream.yaml
+++ b/.github/workflows/check-with-upstream.yaml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Check if KSM selectors are present on applicable metrics.
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         persist-credentials: false
     - run: make --always-make check-selectors-ksm
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 94cc33610..75c5580a1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -30,10 +30,10 @@ jobs:
             run: make --always-make test
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version-file: scripts/go.mod
           cache-dependency-path: scripts/go.sum
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e81733465..3b600510f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create release on kubernetes-mixin
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
         env: 
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 8eec16c16..4300a503a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -10,7 +10,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           days-before-stale: 30
           days-before-close: 7

From 49cdb36af43116155ff4a8b378eba6b2d049b587 Mon Sep 17 00:00:00 2001
From: Stephen Lang <stephen.lang@grafana.com>
Date: Mon, 28 Apr 2025 15:48:19 +0100
Subject: [PATCH 2/3] ci: increase dependabot to weekly

---
 .github/dependabot.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 00caf923d..d9add814e 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -8,8 +8,8 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: monthly
+      interval: weekly
   - package-ecosystem: gomod
     directory: /scripts
     schedule:
-      interval: monthly
+      interval: weekly

From 40ae2bd01a280680e67ccb19dadc1209abb8193b Mon Sep 17 00:00:00 2001
From: Stephen Lang <stephen.lang@grafana.com>
Date: Mon, 28 Apr 2025 15:48:42 +0100
Subject: [PATCH 3/3] ci: prevent duplicate ci workflow

---
 .github/workflows/ci.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 75c5580a1..c72ffe8b2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,7 +1,9 @@
 name: ci
 on:
-  - push
-  - pull_request
+  push:
+    branches:
+      - main
+  pull_request:
 jobs:
   matrix:
     runs-on: ubuntu-latest