Pin action versions, add Dependabot cooldown and npm release age

.github/dependabot.yml

@@ -9,8 +9,24 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Hold back brand-new releases: the hours after publication are the window
+    # in which a compromised package version is most likely to still be live.
+    cooldown:
+      default-days: 7
     # Bundle all npm updates into a single grouped PR per run.
     groups:
       npm-dependencies:
         patterns:
           - "*"
+
+  # Keeps the exact action versions pinned in .github/workflows from going stale.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/command.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Slash Command Dispatch
-        uses: peter-evans/slash-command-dispatch@v3
+        uses: peter-evans/slash-command-dispatch@v3.0.2
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
           reaction-token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}

.github/workflows/release.yml

@@ -14,18 +14,18 @@ jobs:
       WOOSMAP_PUBLIC_API_KEY: "${{ secrets.WOOSMAP_PUBLIC_API_KEY }}"
       WOOSMAP_PRIVATE_API_KEY: "${{ secrets.WOOSMAP_PRIVATE_API_KEY }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4.3.0
         with:
           version: 9.15.9
       - name: Install dependencies
         run: pnpm i --frozen-lockfile
       - run: pnpm run build
       - run: pnpm test
       - name: Semantic Release
-        uses: cycjimmy/semantic-release-action@v4
+        uses: cycjimmy/semantic-release-action@v4.2.2
         with:
           extra_plugins: |
             "@semantic-release/commit-analyzer"

.github/workflows/schema-change-notification.yml

@@ -13,7 +13,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
 
@@ -33,7 +33,7 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Find PR
-        uses: jwalton/gh-find-current-pr@master
+        uses: jwalton/gh-find-current-pr@v1.3.5
         id: findPr
         with:
           state: all
@@ -44,7 +44,7 @@ jobs:
 
       - name: Comment on PR or linked Issue if schemas changed
         if: steps.schema_changes.outputs.changed_files && steps.findPr.outputs.number != ''
-        uses: actions/github-script@v6
+        uses: actions/github-script@v6.4.1
         with:
           github-token: ${{ secrets.HELPER_TOKEN }}
           script: |
@@ -89,7 +89,7 @@ jobs:
 
       - name: Create issue in Woosmap/woosmap if schemas changed
         if: steps.schema_changes.outputs.changed_files && steps.findPr.outputs.number != ''
-        uses: actions/github-script@v6
+        uses: actions/github-script@v6.4.1
         with:
           github-token: ${{ secrets.HELPER_TOKEN }}
           script: |

.github/workflows/test.yml

@@ -5,8 +5,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v4.4.0
+      - uses: pnpm/action-setup@v4.3.0
         with:
           version: 9.15.9
       - name: Install dependencies

.github/workflows/update-devdoc.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dispatch Release Event
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@v2.1.2
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
           repository: woosmap/developers.woosmap.com

.github/workflows/update-dist.yml

@@ -6,12 +6,12 @@ jobs:
   update-dist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
           repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4.3.0
         with:
           version: 9.15.9
       - name: Install dependencies
@@ -25,7 +25,7 @@ jobs:
           git commit -m "chore: update dist folder [skip ci]" || true
           git push origin
       - name: Add reaction
-        uses: peter-evans/create-or-update-comment@v2
+        uses: peter-evans/create-or-update-comment@v2.1.1
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
           repository: ${{ github.event.client_payload.github.payload.repository.full_name }}

.npmrc

@@ -1 +1,7 @@
-hoist=false
+hoist=false
+
+# Delay adopting newly published versions; a compromised release is usually
+# caught within days. min-release-age is npm >= 11.10, minimum-release-age is
+# pnpm >= 10.16 — both inert on the pinned pnpm 9.15.9, effective after a bump.
+min-release-age=7
+minimum-release-age=7