mirror of
https://github.com/iptv-org/iptv
synced 2026-10-22 02:56:48 -04:00
jogerj
4ed2a1f0af
Pin every action reference to the full commit SHA that its current tag already resolves to, with the version kept in a trailing comment. No action changes version as a result of this commit -- including actions/setup-node in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the v6 used by the other workflows. Version bumps are left to Dependabot so they arrive as reviewable PRs. Add .github/dependabot.yml for the github-actions ecosystem: weekly on Monday, minor/patch grouped into a single PR (majors always get their own), "ci" commit prefix. tibdex/github-app-token is ignored to match iptv-org-database; it is archived upstream, so replacing it should be a considered migration rather than an automated bump.