Merge pull request #13 from weglot/chore/github-actions

chore: Lock github actions version and do not persist credentials

Author: VincentLanglet

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      schedule:
+          interval: "weekly"
+      rebase-strategy: "auto"
+      open-pull-requests-limit: 3
+      groups:
+          minor-and-patch:
+               update-types:
+                   - "minor"
+                   - "patch"

.github/workflows/publish.yml

@@ -8,15 +8,22 @@ jobs:
     publish:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v3
-            - uses: actions/setup-node@v3
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  persist-credentials: false
+
+            - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
               with:
                   node-version-file: ".nvmrc"
                   registry-url: https://npm.pkg.github.com/
                   scope: "@weglot"
+
             - run: npm install
+
             - run: git config user.email "41898282+github-actions[bot]@users.noreply.github.com" && git config user.name "github-actions[bot]"
+
             - run: npm version ${GITHUB_REF##*/}
+
             - run: npm publish
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}