chore(deps): add dependabot and SHA-pin workflow deps, linter

Author: frenchi

.github/workflows/readme-check.yml

@@ -1,4 +1,4 @@
-name: README Check
+name: Docs Check
 on:
   workflow_dispatch:
   pull_request:
@@ -12,28 +12,28 @@ permissions:
   contents: read
 
 jobs:
-  readme-check:
+  docs-check:
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go
-      uses: actions/setup-go@v5
-    - name: Check out code
-      uses: actions/checkout@v4
-    - name: Check docs is up-to-date
-      run: |
-        go generate ./...
-        if [ -n "$(git status --porcelain)" ]; then
-          echo "ERROR: docs are not up-to-date!"
-          echo ""
-          echo "The docs differ from what would be generated by `go generate ./...`."
-          echo "Please update internal/**/*.src.md instead of directly editing README.md or docs/ files,"
-          echo "then run `go generate ./...` to regenerate docs."
-          echo ""
-          echo "Changes:"
-          git status --porcelain
-          echo ""
-          echo "Diff:"
-          git diff
-          exit 1
-        fi
-        echo "Docs are up-to-date."
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
+      - name: Check out code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - name: Check docs are up-to-date
+        run: |
+          go generate ./...
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "ERROR: docs are not up-to-date!"
+            echo ""
+            echo "The docs differ from what would be generated by `go generate ./...`."
+            echo "Please update internal/**/*.src.md instead of directly editing README.md or docs/ files,"
+            echo "then run `go generate ./...` to regenerate docs."
+            echo ""
+            echo "Changes:"
+            git status --porcelain
+            echo ""
+            echo "Diff:"
+            git diff
+            exit 1
+          fi
+          echo "Docs are up-to-date."

.github/workflows/test.yml

@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: "^1.23"
       - name: Check formatting
@@ -31,7 +31,7 @@ jobs:
       - name: Run Go vet
         run: go vet ./...
       - name: Run staticcheck
-        uses: dominikh/staticcheck-action@v1
+        uses: dominikh/staticcheck-action@024238d2898c874f26d723e7d0ff4308c35589a2 # v1
         with:
           version: "latest"
 
@@ -42,9 +42,9 @@ jobs:
         go: ["1.23", "1.24", "1.25"]
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: ${{ matrix.go }}
       - name: Test
@@ -54,9 +54,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: "1.24"
       - name: Test with -race