improve dependabot configuration

Author: GyulyVGC

.github/dependabot.yml

@@ -10,15 +10,31 @@ updates:
 - package-ecosystem: "github-actions"
   directory: "/"
   schedule:
-    interval: "daily"
+    interval: "weekly"
   cooldown:
     default-days: 7
-  
+  ignore:
+    # Major-pinned actions: only surface major updates.
+    - dependency-name: "actions/*"
+      update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+    - dependency-name: "codecov/codecov-action"
+      update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+    - dependency-name: "github/codeql-action"
+      update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+  groups:
+    # Bundle all action updates into a single PR to review at once
+    github-actions:
+      patterns: ["*"]
+
 # Maintain dependencies for cargo
 - package-ecosystem: cargo
   directory: "/"
   schedule:
-    interval: "daily"
+    interval: "weekly"
   target-branch: "main"
   cooldown:
     default-days: 7
+  groups:
+    # Bundle all cargo updates into a single PR to review at once
+    cargo:
+      patterns: ["*"]

.github/workflows/docker.yml

@@ -29,20 +29,20 @@ jobs:
           fi
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: GyulyVGC
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64

.github/workflows/package.yml

@@ -411,7 +411,7 @@ jobs:
           if-no-files-found: error
 
       - name: Sign package artifacts
-        uses: signpath/github-action-submit-signing-request@v2.2
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
           organization-id: '3b533e02-73c3-4908-a018-d09a34498a6a'