From 01e11a109498ee4cfe19d04623d000fa7f9d42e7 Mon Sep 17 00:00:00 2001
From: Oliver Kurz <okurz@suse.de>
Date: Tue, 30 Jun 2026 14:23:34 +0200
Subject: [PATCH 1/2] feat(ci): pin GitHub Actions by commit hash

Motivation:
Secure GitHub Actions workflows against git tag hijacking attacks.

Design Choices:
Replace version tags with full 40-character SHA-1 hashes.
Preserve tags as comments for easy reference.

Benefits:
Ensures workflow immutability and compliance with security
best practices.

Related issue: https://progress.opensuse.org/issues/203049
---
 .github/dependabot.yml          | 14 ++++++++++++++
 .github/workflows/ci-tests.yaml |  6 +++---
 .github/workflows/perltidy.yml  |  2 +-
 3 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..e09f777
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      all-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci-tests.yaml b/.github/workflows/ci-tests.yaml
index d6a0027..70a3fdd 100644
--- a/.github/workflows/ci-tests.yaml
+++ b/.github/workflows/ci-tests.yaml
@@ -22,8 +22,8 @@ jobs:
             perl: latest
     name: 🐪 Perl ${{ matrix.perl }} on ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: shogo82148/actions-setup-perl@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: shogo82148/actions-setup-perl@a198315ec4e9244f206879ea7b63078003aec8a6 # v1
         with:
           perl-version: ${{ matrix.perl }}
       - name: perl -V
@@ -45,7 +45,7 @@ jobs:
           ./retry -r 7 env TEST_SHARED=1 TEST_SUBREAPER=1 PERL5OPT="-MDevel::Cover=-coverage,statement" prove -l t
           cover -report codecovbash
       - name: Upload coverage to ☂️ Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
         if: matrix.perl == 'latest' && matrix.os != 'macos-latest'
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/perltidy.yml b/.github/workflows/perltidy.yml
index 7090f92..4a01e56 100644
--- a/.github/workflows/perltidy.yml
+++ b/.github/workflows/perltidy.yml
@@ -12,7 +12,7 @@ jobs:
     container:
       image: perl:5.32
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: perl -V
         run: perl -V
       - name: Install dependencies

From 79415555dc2e54e448996c39bc004a05bf78a83a Mon Sep 17 00:00:00 2001
From: Oliver Kurz <okurz@suse.de>
Date: Tue, 30 Jun 2026 14:44:42 +0200
Subject: [PATCH 2/2] fix(ci): format inline comments in workflows to pass
 yamllint

Motivation:
Workflow files failed yamllint checkstyle checks due to inline comments
only having 1 space instead of the expected 2.

Design Choices:
Reformat comment prefixes to use 2 spaces before '#'.

Benefits:
Fixes CI checkstyle/yaml-syntax validation errors.

Related issue: https://progress.opensuse.org/issues/203049
---
 .github/workflows/ci-tests.yaml | 6 +++---
 .github/workflows/perltidy.yml  | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-tests.yaml b/.github/workflows/ci-tests.yaml
index 70a3fdd..38b7e4d 100644
--- a/.github/workflows/ci-tests.yaml
+++ b/.github/workflows/ci-tests.yaml
@@ -22,8 +22,8 @@ jobs:
             perl: latest
     name: 🐪 Perl ${{ matrix.perl }} on ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: shogo82148/actions-setup-perl@a198315ec4e9244f206879ea7b63078003aec8a6 # v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: shogo82148/actions-setup-perl@a198315ec4e9244f206879ea7b63078003aec8a6  # v1
         with:
           perl-version: ${{ matrix.perl }}
       - name: perl -V
@@ -45,7 +45,7 @@ jobs:
           ./retry -r 7 env TEST_SHARED=1 TEST_SUBREAPER=1 PERL5OPT="-MDevel::Cover=-coverage,statement" prove -l t
           cover -report codecovbash
       - name: Upload coverage to ☂️ Codecov
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac  # v5
         if: matrix.perl == 'latest' && matrix.os != 'macos-latest'
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/perltidy.yml b/.github/workflows/perltidy.yml
index 4a01e56..e1647ee 100644
--- a/.github/workflows/perltidy.yml
+++ b/.github/workflows/perltidy.yml
@@ -12,7 +12,7 @@ jobs:
     container:
       image: perl:5.32
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
       - name: perl -V
         run: perl -V
       - name: Install dependencies