Pin GitHub Actions to commit SHAs (#218)

Also sets up dependabot for just actions

Author: benbrandt

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -17,8 +17,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v6
         with:
-          node-version: '24'
-      - uses: oven-sh/setup-bun@v2
+          node-version: "24"
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.11
       - name: Install dependencies

.github/workflows/codex-update.yml

@@ -2,17 +2,17 @@ name: Codex Update
 
 on:
   schedule:
-    - cron: '0 5 * * *' 
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 permissions:
   contents: read
   packages: read
 
 env:
-  CODEX_PACKAGE: '@openai/codex'
-  CODEX_UPDATE_LABEL: 'codex-update'
-  GITHUB_BOT_USERNAME: 'github-actions[bot]'
+  CODEX_PACKAGE: "@openai/codex"
+  CODEX_UPDATE_LABEL: "codex-update"
+  GITHUB_BOT_USERNAME: "github-actions[bot]"
 
 jobs:
   check:
@@ -83,20 +83,20 @@ jobs:
 
       - name: Finalize update with Codex
         id: codex-finalize
-        uses: openai/codex-action@v1
+        uses: openai/codex-action@10cb888d2ed3b99867f7e7ccff174a861a75aeb6
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           codex-version: ${{ env.VERSION }}
           output-file: pr-body.md
           codex-args: >-
             -c sandbox_workspace_write.writable_roots=["${{ github.workspace }}/.git"]
           prompt: >
-            Finalize the update using codex-update-compat skill. 
-            Commit the changes, the message should mention that types or/and tests after the update were fixed. 
+            Finalize the update using codex-update-compat skill.
+            Commit the changes, the message should mention that types or/and tests after the update were fixed.
             When creating the final message do not mention:
             * Validation run details.
             * Commits.
-            * Hyperlinks. 
+            * Hyperlinks.
             Mention only previously failed tests with failure reasons, also what you changed and why.
 
       - name: Push branch updates
@@ -143,4 +143,3 @@ jobs:
             gh pr close "$pr_number" \
               --comment "Closing obsolete update PR"
           done
-