ci: pin GitHub Actions to commit SHAs and add Dependabot

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions-minor-patch:
+        update-types: ["minor", "patch"]
+    commit-message:
+      prefix: "ci"
+    ignore:
+      # Deliberately held at v1.8.2: 7c776462 switched deploy.yml to
+      # actions/create-github-app-token@v2, 5c2520c4 reverted it three days later.
+      - dependency-name: "tibdex/github-app-token"

.github/workflows/check.yml

@@ -9,8 +9,8 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22.12.0'
           cache: 'npm'
@@ -29,7 +29,7 @@ jobs:
         if: steps.files.outputs.any_changed == 'true'
         run: npm install
       - name: check if files are crlf
-        uses: kforeverisback/check-crlf-extended@v2
+        uses: kforeverisback/check-crlf-extended@bb2dea99a7da756525ede285d33811e5552d3ceb # v2
         continue-on-error: false
         with:
           directory: ./data

.github/workflows/deploy.yml

@@ -10,29 +10,29 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: tibdex/github-app-token@v1.8.2
+      - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ env.ACT }}
         with:
           token: ${{ github.token }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ !env.ACT }}
         with:
           token: ${{ steps.create-app-token.outputs.token }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22.12.0'
           cache: 'npm'
       - name: install dependencies
         run: npm install
       - name: export data to ./api
         run: npm run db:export
-      - uses: JamesIves/github-pages-deploy-action@4.1.1
+      - uses: JamesIves/github-pages-deploy-action@164583b9e44b4fc5910e78feb607ea7c98d3c7b9 # 4.1.1
         if: ${{ !env.ACT && github.ref == 'refs/heads/master' }}
         with:
           repository-name: iptv-org/api

.github/workflows/update.yml

@@ -9,21 +9,21 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ env.ACT }}
         with:
           token: ${{ github.token }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ !env.ACT }}
         with:
           token: ${{ steps.create-app-token.outputs.token }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22.12.0'
           cache: 'npm'
@@ -37,7 +37,7 @@ jobs:
       - name: validate changes
         run: npm run db:validate
       - name: check if files are crlf
-        uses: kforeverisback/check-crlf-extended@v2
+        uses: kforeverisback/check-crlf-extended@bb2dea99a7da756525ede285d33811e5552d3ceb # v2
         continue-on-error: false
         with:
           directory: ./data

.github/workflows/validate_issue.yml

@@ -17,17 +17,17 @@ jobs:
       contains(join(github.event.issue.labels.*.name, ','), 'blocklist:')
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: 'npm'

.github/workflows/validate_label.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with: