fix(security): ci

[SirSimon04]

fix(security): Pin GitHub Actions to Full Commit SHAs

🔒 Security: Pinned all GitHub Actions dependencies to their full commit SHAs to prevent supply chain attacks, and added Dependabot configuration for automated dependency updates.

Changes

• .github/dependabot.yml: New file — Added Dependabot configuration to automatically track and update both npm and github-actions dependencies on a weekly schedule with a 7-day cooldown.

• .github/actions/integration-tests/action.yml: Pinned actions/checkout and actions/setup-node to full commit SHAs. Refactored CF authentication to use environment variables instead of inline ${{ inputs.* }} expressions (avoids secret/input leakage in logs), removed the debug log line that printed CF_API, and split cf login into separate cf api, cf auth, and cf target commands.

• .github/workflows/check-changelog.yml: Pinned tarides/changelog-check-action to full commit SHA.

• .github/workflows/issue.yml: Pinned actions/github-script to full commit SHA.

• .github/workflows/lint.yml: Pinned actions/setup-node and actions/checkout to full commit SHAs in both lint and prettier jobs.

• .github/workflows/release.yml: Pinned actions/checkout, actions/setup-node, martinbeentjes/npm-get-version-action, schwma/parse-changelog-action, and ncipollo/release-action to full commit SHAs.

• .github/workflows/stale.yml: Pinned actions/stale to full commit SHA.

• .github/workflows/test.yml: Pinned actions/checkout and actions/setup-node to full commit SHAs across all jobs. Replaced the local action reference for integration tests with the fully-qualified cap-js/attachments/.github/actions/integration-tests@main path, removing the redundant checkout step that preceded it.

• 🔄 Regenerate and Update Summary

PR Bot Information

Version: 1.20.37

• File Content Strategy: Full file content
• LLM: anthropic--claude-4.6-sonnet
• Event Trigger: pull_request.opened
• Summary Prompt: Default Prompt
• Output Template: Default Template
• Correlation ID: 3586f350-fe23-4b87-b318-995d0dcdf287

[hyperspace-insights]

The PR makes good progress on supply-chain security by pinning all action references to immutable commit SHAs and moving CF credentials out of the command line into environment variables. However, three issues were flagged: the integration-tests composite action is still referenced via the mutable @main branch (undermining the whole SHA-pinning effort), cf auth should pass credentials as explicit arguments rather than relying silently on env-var forwarding, and both lint.yml jobs have setup-node invoked before checkout, which is the wrong order.

PR Bot Information

Version: 1.20.37

• Event Trigger: pull_request.opened
• File Content Strategy: Full file content
• LLM: anthropic--claude-4.6-sonnet
• Correlation ID: 3586f350-fe23-4b87-b318-995d0dcdf287

[KoblerS]

LGMT! :)