From 57139bface78e27011ebbdd7dc51432d73de3c8e Mon Sep 17 00:00:00 2001
From: GitHub Security Bot
 <88103841+github-security-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:31:31 -0400
Subject: [PATCH] Pin GitHub Actions to commit SHAs

---
 .github/dependabot.yml   | 2 ++
 .github/workflows/ci.yml | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 79fc83a..0f93bf5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0930434..7f9193e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,8 +26,8 @@ jobs:
           - "3.2"
           - "3.3"
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby_version }}
           bundler-cache: true