🩹 [Patch]: Pin GitHub Actions to specific versions for improved security

[Copilot]

GitHub Actions are now pinned to specific commit SHAs instead of version tags, improving security by preventing supply chain attacks through tag manipulation. Additionally, Dependabot has been configured to run daily with a 7-day cooldown to keep dependencies up-to-date automatically.

• Fixes 🩹[Patch]: Fix dangerous-triggers linter error in Auto-Release workflow #22

GitHub Actions SHA pinning

All workflow files now reference actions by their full commit SHA rather than version tags. This ensures workflows always use a verified, immutable version of each action.

Changed actions:

• actions/checkout@v5 → actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 (v6.0.1)
• PSModule/Auto-Release@v1 → PSModule/Auto-Release@eabd533035e2cb9822160f26f2eda584bd012356 (v1.9.5)
• super-linter/super-linter@latest → super-linter/super-linter@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99 (v8.3.2)
• PSModule/GitHub-Script@v1 → PSModule/GitHub-Script@2010983167dc7a41bcd84cb88e698ec18eccb7ca (v1.7.8)

Dependabot configuration

Dependabot now checks for updates daily with a 7-day cooldown between updates, replacing the previous weekly schedule. This provides faster awareness of security updates while avoiding excessive noise.

schedule:
  interval: daily
cooldown:
  default-days: 7

Linter configuration

Added configuration to disable validation checks that are not applicable to this repository:

• VALIDATE_BIOME_FORMAT: false
• VALIDATE_JSCPD: false

[MariusStorhaug]

@copilot Lets change it and analyze the implications to it being run on pull_request trigger vs the pull_request_target.

[Copilot]

@copilot Lets change it and analyze the implications to it being run on pull_request trigger vs the pull_request_target.

Changed to pull_request trigger in commit 968475d.

Key implications:

🔴 Breaking for fork PRs:

• GITHUB_TOKEN becomes read-only (cannot create releases or comment)
• No access to repository secrets
• Auto-Release action will fail on fork PRs

✅ Works for same-repo PRs:

• Full write permissions maintained
• All functionality works as expected

⚠️ Permissions mismatch:

• Workflow declares contents: write and pull-requests: write
• Fork PRs run with read-only token regardless of declaration
• Could cause silent failures

Recommendation: This change is suitable if the repository is private or only accepts PRs from collaborators (not forks). For public repos accepting fork contributions, pull_request_target with security mitigations is necessary.