251109.2.1 · 7014993561ae64b53bbc8aa8f84dfd44a310d16e

ci: resolve Zizmor-identified workflow issues

* Set dependabot cooldown timer of 7 days, which helps mitigate
stability and supply-chain security risks. For more info, see
https://docs.zizmor.sh/audits/#dependabot-cooldown
* Restrict write permissions to the job that actually needs them.
* Set `persist-credentials: false` for `actions/checkout`. See
https://docs.zizmor.sh/audits/#artipacked
* Use environment variables instead of template expansions in code
contexts. See https://docs.zizmor.sh/audits/#template-injection
* Pin action dependencies to SHA hashes.

@@ -4,7 +4,11 @@ updates:     directory: "/"     schedule:       interval: "monthly"+    cooldown:+      default-days: 7   - package-ecosystem: "github-actions"     directory: "/"     schedule:       interval: "daily"+    cooldown:+      default-days: 7