From 04e3143ee87ddcb8f7be5c7c3767f2c1ac6e3803 Mon Sep 17 00:00:00 2001
From: GitHub Security Bot
 <88103841+github-security-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:26:33 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs

---
 .github/dependabot.yaml    | 2 ++
 .github/workflows/test.yml | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index ec67847e..643cbf78 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -9,3 +9,5 @@ updates:
     directory: '/'
     schedule:
         interval: 'weekly'
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4b155a6d..d0457ff8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{matrix.ruby}}
         bundler-cache: true