[OskarEichler]

Summary

• Pin every third-party GitHub Action to a reviewed immutable commit while retaining the release tag in a comment.
• Add weekly Dependabot updates for GitHub Actions so pinned revisions remain maintainable.

Security impact

LOW urgency. The scheduled database-update workflow grants contents: write and pull-requests: write. Mutable action tags let a later upstream tag move change the code executed with that token. Full commit SHAs keep the reviewed workflow dependency immutable.

The same pins are applied to the read-only CI jobs for consistency. This is workflow supply-chain hardening; I did not identify an exploitable runtime issue in mini_mime.

Verification

• bundle exec rake test — 34 runs, 74 assertions, 0 failures/errors
• bundle exec rubocop — 13 files, no offenses
• Parsed both workflows and Dependabot configuration with Ruby YAML
• Checked every workflow uses: reference is a full 40-character SHA
• Resolved both pinned revisions and confirmed their action manifests through the GitHub API
• Built and unpacked mini_mime-2.0.0.gem; expected eight packaged files
• git diff --check

Limitations

This does not pin RubyGems updated by the monthly database workflow. Those updates are committed to a pull request and remain subject to repository review.

Breaking changes

None. Runtime and packaged gem contents are unchanged.