Pin GitHub Actions to commit SHAs and add Dependabot

[skearnes]

Version tags are mutable. The tj-actions/changed-files compromise in March 2025 repointed every version tag at a commit that dumped runner secrets into build logs, hitting roughly 23,000 repositories; tag pinning offered no protection and SHA pinning offered complete protection. Three of the actions used here are third-party — astral-sh/setup-uv, shogo82148/actions-setup-redis, and docker/setup-buildx-action.

The Dependabot config is the half that makes this sustainable, and it is not optional. Dependabot understands SHA-pinned actions and rewrites the SHA together with its trailing # vN comment, so pinned workflows keep tracking upstream. Without it, pinning silently freezes the workflows on whatever was current the day they were written — which is exactly what happened in ord-app and ord-infrastructure, both fully SHA-pinned with no update mechanism and both a major version behind on setup-uv.

Updates are grouped so this arrives as one pull request a month rather than one per action.

Every pin resolves the tag that was already in use, so nothing changes behavior. Resolved through the git refs API, dereferencing annotated tags to their commits. All pre-commit hooks pass.

Part of an org-wide sweep alongside ord-schema#910 and ord-data#264.

🤖 Generated with Claude Code

Greptile Summary

Pins every GitHub Actions dependency to an immutable commit SHA and adds monthly grouped Dependabot updates to keep those pins current.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The workflow changes preserve the existing action versions and valid uses syntax, while the new Dependabot configuration covers the pinned actions with a valid grouped monthly update schedule.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a valid monthly grouped update configuration covering GitHub Actions dependencies throughout the repository.
.github/workflows/checks.yml	Replaces mutable action version tags with consistent immutable SHAs while preserving the existing major versions.
.github/workflows/tests.yml	Pins all test workflow actions to consistent immutable SHAs without changing job configuration or execution flow.

_{Reviews (1): Last reviewed commit: "Pin GitHub Actions to commit SHAs and ad..." | Re-trigger Greptile}