From 3457db527d42c7c28ffe22d1ff6261ae0717e1e5 Mon Sep 17 00:00:00 2001
From: Lucas Girouard-Stranks <lithiumtoast@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:43:44 -0400
Subject: [PATCH 1/2] Bump actions to their latest majors (Node 24)

---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e35bf63..a5ffbd1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,10 +25,10 @@ jobs:
     steps:
 
     - name: "Clone Git repository"
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: "Setup .NET"
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@v6
       with:
         global-json-file: global.json
 

From 673bf46bab55c67816c00bcdf1686ea19208ebd4 Mon Sep 17 00:00:00 2001
From: Lucas Girouard-Stranks <lithiumtoast@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:51:41 -0400
Subject: [PATCH 2/2] Pin actions to commit SHAs and add Dependabot

Tags like `@v1` move when the action ships a new minor version. Pinning to the
commit SHA (with the version in a comment) makes updates deliberate; Dependabot
opens a pull request when a new version is released.
---
 .github/dependabot.yml     | 6 ++++++
 .github/workflows/test.yml | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5ace460
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a5ffbd1..842736a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,10 +25,10 @@ jobs:
     steps:
 
     - name: "Clone Git repository"
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: "Setup .NET"
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         global-json-file: global.json