Pin the actions to commits, and let Dependabot move them

`actions/checkout@v4` is a tag, and a tag is a pointer its owner can move. Whoever controls it
controls what runs in CI — with a checkout of this repository, a composer install, and whatever
secrets the job is given. `ramsey/composer-install@v3` is not even a tag: it is a branch, so its
tip moves with every commit the maintainer makes, and `@v3` today and `@v3` tomorrow are not
promised to be the same code.

A commit hash is the one reference nobody can move out from under you. It costs automatic
updates, so those go to Dependabot: a pull request per version, with the release notes, which is
the same update decided by somebody rather than arriving unannounced.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARqBYLxrHqevcVmxHkpJcZ

Author: radek-ziemniewicz

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+
+updates:
+  # The actions are pinned to commits, which is the only form of pinning a tag cannot be moved
+  # out from under. That leaves updating them a manual job, so it is given to somebody whose
+  # job it is: a pull request per new version, with the release notes attached.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: CI

.github/workflows/tests.yml

@@ -16,14 +16,14 @@ jobs:
       matrix:
         php: ['8.1', '8.2', '8.3', '8.4']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php }}
           coverage: none
 
-      - uses: ramsey/composer-install@v3
+      - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # v3
 
       - name: Unit tests
         run: vendor/bin/unit-tests
@@ -34,16 +34,16 @@ jobs:
     env:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           coverage: none
 
-      - uses: ramsey/composer-install@v3
+      - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # v3
 
       - name: Unit tests with coverage
         run: phpdbg -qrr vendor/bin/unit-tests
@@ -53,22 +53,22 @@ jobs:
         if: env.SONAR_TOKEN != ''
         # Reporting, not a gate: a token which has expired should not turn a green suite red.
         continue-on-error: true
-        uses: SonarSource/sonarqube-scan-action@v5
+        uses: SonarSource/sonarqube-scan-action@2f77a1ec69fb1d595b06f35ab27e97605bdef703 # v5
         env:
           SONAR_HOST_URL: https://sonarcloud.io
 
   static-analysis:
     name: Static analysis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           coverage: none
 
-      - uses: ramsey/composer-install@v3
+      - uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # v3
 
       - name: PHPStan
         run: vendor/bin/phpstan analyse --no-progress