0aa6abe517
following githubs recommendations[^3rd-p-a] to use full-length commit SHA for 3rd-party actions setup dependabot to help keep dependencies up-to-date [^3rd-p-a]: https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions