From 703a22357c97f003126583d0621cdfe97fdfd767 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Ricks?= <bjoern.ricks@greenbone.net>
Date: Mon, 10 Aug 2026 14:26:28 +0200
Subject: [PATCH] CI: Update dependabot config and pin actions to commits

Only update greenbone actions for major updates because we trust these
tags and don't want to get PRs for each bugfix or minor releases.

Also group updates for github's native actions in one PR to allow for
less required reviews.

Pin actions to commits for improved security. Git tags can be overridden easily.
Hashes not.
---
 .github/dependabot.yml                | 12 +++++++++++-
 .github/workflows/changelog.yml       |  4 ++--
 .github/workflows/ci-c.yml            |  8 ++++----
 .github/workflows/codeql-analysis.yml |  7 ++++---
 .github/workflows/release.yml         |  2 +-
 5 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 99602049f5..0d2d47591f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,7 +1,17 @@
 version: 2
 updates:
-
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "actions/*"
+    ignore:
+      - dependency-name: "greenbone/actions"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+    commit-message:
+      prefix: "Deps"
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index dd320426d7..75e8b5092e 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -6,10 +6,10 @@ on:
 jobs:
   changelog:
     name: Show changelog since last release
-    runs-on: 'ubuntu-latest'
+    runs-on: "ubuntu-latest"
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # for conventional commits and getting all git tags
           persist-credentials: false
diff --git a/.github/workflows/ci-c.yml b/.github/workflows/ci-c.yml
index c0a645ef18..53111974ad 100644
--- a/.github/workflows/ci-c.yml
+++ b/.github/workflows/ci-c.yml
@@ -13,7 +13,7 @@ jobs:
     name: Check C Source Code Formatting
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check Source Format
         run: |
           clang-format -i -style=file src/*.{c,h}
@@ -30,7 +30,7 @@ jobs:
           - testing
     container: ghcr.io/greenbone/gvm-libs:${{ matrix.container }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install build dependencies
         run: sh .github/install-dependencies.sh .github/build-dependencies.list
       - name: Configure and compile gsad
@@ -48,7 +48,7 @@ jobs:
         run: |
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git libcgreen1-dev
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install build dependencies
         run: sh .github/install-dependencies.sh .github/build-dependencies.list
       - name: Configure and compile gsad
@@ -68,7 +68,7 @@ jobs:
     name: Check CMake Formatting
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: greenbone/actions/uv@v3
         with:
           install: gersemi
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 7a15cde8ed..8750f227da 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,11 +25,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: C
+          build-mode: manual
         # build between init and analyze ...
       - name: Install build dependencies
         run: sh .github/install-dependencies.sh .github/build-dependencies.list
@@ -41,4 +42,4 @@ jobs:
           cmake -DCMAKE_BUILD_TYPE=Debug ..
           make install
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8e9b29cb3..94fe228243 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
         with:
           release-type-input: ${{ inputs.release-type }}
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # for conventional commits and getting all git tags
           persist-credentials: false