From e9309c4ac49446da6149b6417c29e073f0e4e3de Mon Sep 17 00:00:00 2001
From: GitHub Security Bot
 <88103841+github-security-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:23:57 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml            | 8 ++++++++
 .github/workflows/close-pulls.yml | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..6cc00712d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/close-pulls.yml b/.github/workflows/close-pulls.yml
index 8a95bccc0..53cac6751 100644
--- a/.github/workflows/close-pulls.yml
+++ b/.github/workflows/close-pulls.yml
@@ -11,7 +11,7 @@
       
       steps:
         - name: Close Pull Requests
-          uses: peter-evans/close-fork-pulls@v2
+          uses: peter-evans/close-fork-pulls@759a18619e1876d53588173e9321d49a00188360 # v2.0.1
           with:
             comment: |
               As of 2023-11-30 we have stopped the 2-way sync between this repository and our internal repository, so that our internal repository becomes the source of truth for the backup-utils source code. With the the 2-way sync stopped, this public repository will be used to host documentation about backup-utils and to publish new versions of backup-utils. You will be able to access a specific version of backup-utils (which includes the full source code) from the [release page](https://github.com/github/backup-utils/releases) of this repository.