ci: use hash-pinned actions (#43)

dependabot: consolidate updated using groups

Author: cesarcoatl

.github/dependabot.yml

@@ -1,10 +1,16 @@
 version: 2
 updates:
-  # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "quarterly"
+    groups:
+      coatl-dev-actions:
+        patterns:
+          - "coatl-dev/actions/**"
+      coatl-dev-workflows:
+        patterns:
+          - "coatl-dev/workflows/**"
     labels: ["dependencies"]
     commit-message:
       prefix: "ci"

.github/workflows/ci.yml

@@ -8,10 +8,10 @@ on:
 
 jobs:
   pylint:
-    uses: coatl-dev/workflows/.github/workflows/pylint.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/pylint.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
     with:
       path: src
 
   tox:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: ./.github/workflows/tox.yml
+    uses: $/.github/workflows/tox.yml

.github/workflows/publish.yml

@@ -7,22 +7,22 @@ on:
 
 jobs:
   tox:
-    uses: ./.github/workflows/tox.yml
+    uses: $/.github/workflows/tox.yml
 
   pypi-upload:
     needs: tox
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Upload package to PyPI
-        uses: coatl-dev/actions/pypi-upload@v5
+        uses: coatl-dev/actions/pypi-upload@45ee24a8c8397a346538acefea6221e30076fa66 # v7.0.14
         with:
           password: ${{ secrets.PYPI_API_TOKEN_JAVA_API_PKG }}
 
       - name: Upload stubs to PyPI
-        uses: coatl-dev/actions/pypi-upload@v5
+        uses: coatl-dev/actions/pypi-upload@45ee24a8c8397a346538acefea6221e30076fa66 # v7.0.14
         with:
           python-version: '3.12'
           password: ${{ secrets.PYPI_API_TOKEN_JAVA_API_STUBS }}

.github/workflows/tox.yml

@@ -5,10 +5,10 @@ on:
 
 jobs:
   tox-package:
-    uses: coatl-dev/workflows/.github/workflows/tox-docker.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/tox-docker.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
 
   tox-stubs:
-    uses: coatl-dev/workflows/.github/workflows/tox.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/tox.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
     with:
       python-versions: |
         3.9