chore: harden supply chain — pin actions, fix template injection, update deps

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -20,13 +20,15 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Enable Corepack
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "lts/*"
           cache: "pnpm"

.github/workflows/release-tags.yml

@@ -13,21 +13,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           fetch-tags: true
+          persist-credentials: false
 
       - name: Configure git
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Update major version tag
+        env:
+          TAG: ${{ github.event.release.tag_name }}
         run: |
-          # Get the release tag (e.g., v1.2.3)
-          TAG="${{ github.event.release.tag_name }}"
-
           # Extract major version (e.g., v1)
           if [[ $TAG =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
             MAJOR_TAG="v${BASH_REMATCH[1]}"

.github/workflows/release.yml

@@ -21,15 +21,16 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Enable Corepack
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "lts/*"
           cache: "pnpm"
@@ -44,7 +45,7 @@ jobs:
 
       - name: Create Release PR or Tag
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
         with:
           version: pnpm run version
           publish: pnpm run release

action.yml

@@ -44,7 +44,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: "lts/*"
 
@@ -62,7 +62,7 @@ runs:
         echo "LOCK_HASH=$LOCK_HASH" >> $GITHUB_OUTPUT
 
     - name: Cache pnpm store
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ steps.cache-keys.outputs.PNPM_STORE }}
         key: tempo-lints-pnpm-store-${{ runner.os }}-${{ steps.cache-keys.outputs.LOCK_HASH }}
@@ -71,7 +71,7 @@ runs:
 
     - name: Cache node_modules (includes sg binary)
       id: cache-node-modules
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ github.action_path }}/node_modules
         key: tempo-lints-node-modules-${{ runner.os }}-${{ steps.cache-keys.outputs.LOCK_HASH }}

package.json

@@ -48,13 +48,14 @@
 	},
 	"homepage": "https://github.com/tempoxyz/lints#readme",
 	"devDependencies": {
-		"@biomejs/biome": "^2.3.11",
-		"@changesets/cli": "^2.27.1",
-		"@types/node": "^25.0.10",
+		"@biomejs/biome": "^2.4.11",
+		"@changesets/cli": "^2.30.0",
+		"@types/node": "^25.6.0",
 		"@typescript/native-preview": "7.0.0-dev.20260122.4",
 		"tsx": "^4.21.0",
 		"typescript": "^5.9.3",
-		"vitest": "^4.0.18"
+		"vite": "^8.0.8",
+		"vitest": "^4.1.4"
 	},
 	"dependencies": {
 		"@ast-grep/cli": "^0.40.5",