From 41ae6be5b6b10897cbcd4783b03323f210da0faf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Rom=C3=A1n?= <cesar@coatl.dev>
Date: Mon, 31 Aug 2026 21:37:51 -0700
Subject: [PATCH] ci: use hash-pinned actions

dependabot: consolidate updated using groups
---
 .github/dependabot.yml        | 8 +++++++-
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/publish.yml | 8 ++++----
 .github/workflows/tox.yml     | 4 ++--
 4 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ae8d3f3..328ae39 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,16 @@
 version: 2
 updates:
-  # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "quarterly"
+    groups:
+      coatl-dev-actions:
+        patterns:
+          - "coatl-dev/actions/**"
+      coatl-dev-workflows:
+        patterns:
+          - "coatl-dev/workflows/**"
     labels: ["dependencies"]
     commit-message:
       prefix: "ci"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ca75e0..d795694 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,10 +8,10 @@ on:
 
 jobs:
   pylint:
-    uses: coatl-dev/workflows/.github/workflows/pylint.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/pylint.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
     with:
       path: src
 
   tox:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: ./.github/workflows/tox.yml
+    uses: $/.github/workflows/tox.yml
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ff04c32..27c95ba 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,22 +7,22 @@ on:
 
 jobs:
   tox:
-    uses: ./.github/workflows/tox.yml
+    uses: $/.github/workflows/tox.yml
 
   pypi-upload:
     needs: tox
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Upload package to PyPI
-        uses: coatl-dev/actions/pypi-upload@v5
+        uses: coatl-dev/actions/pypi-upload@45ee24a8c8397a346538acefea6221e30076fa66 # v7.0.14
         with:
           password: ${{ secrets.PYPI_API_TOKEN_JAVA_API_PKG }}
 
       - name: Upload stubs to PyPI
-        uses: coatl-dev/actions/pypi-upload@v5
+        uses: coatl-dev/actions/pypi-upload@45ee24a8c8397a346538acefea6221e30076fa66 # v7.0.14
         with:
           python-version: '3.12'
           password: ${{ secrets.PYPI_API_TOKEN_JAVA_API_STUBS }}
diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
index 30b12ff..dcab48d 100644
--- a/.github/workflows/tox.yml
+++ b/.github/workflows/tox.yml
@@ -5,10 +5,10 @@ on:
 
 jobs:
   tox-package:
-    uses: coatl-dev/workflows/.github/workflows/tox-docker.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/tox-docker.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
 
   tox-stubs:
-    uses: coatl-dev/workflows/.github/workflows/tox.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/tox.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
     with:
       python-versions: |
         3.9