upgrading actions, dependabot

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+    groups:
+      github-actions-minor:
+        update-types:
+          - minor
+          - patch

.github/workflows/build-for-heroku.yml

@@ -47,13 +47,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Heroku CLI
         if: ${{ env.ACT }}
         run: curl https://cli-assets.heroku.com/install-ubuntu.sh | sh
 
-      - uses: akhileshns/heroku-deploy@v3.12.13 # This is the action
+      - uses: akhileshns/heroku-deploy@1b080913896a5d6d44a18e9e208f8eb1fee9b0f7 # v3.15.15
         with:
           heroku_api_key: ${{secrets.HEROKU_API_KEY}}
           heroku_app_name: ${{ inputs.heroku_app_name }} # Must be unique in Heroku

.github/workflows/caprover-configure-app.yml

@@ -96,13 +96,13 @@ jobs:
       name: ${{ inputs.caproverAppName }}
       url: ${{ inputs.deployTargetUrl || env.defaultDeployTargetUrl }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: cardinalby/export-env-action@2.2.0
+      - uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
         with:
           envFile: ${{ inputs.envFile }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -158,7 +158,7 @@ jobs:
       - name: Enable SSL 🔒
         run: bunx caprover api --path=/user/apps/appDefinitions/enablebasedomainssl --method=POST --data='{"appName":"${{ inputs.caproverAppName }}"}'
 
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         if: ${{ inputs.discordWebhook }}
         with:
           webhook: ${{ inputs.discordWebhook }}

.github/workflows/caprover-deploy.yml

@@ -41,12 +41,12 @@ jobs:
       name: ${{ inputs.caproverAppName }}
       url: ${{ inputs.deployTargetUrl || env.defaultDeployTargetUrl }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: cardinalby/export-env-action@2.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
         with:
           envFile: ${{ inputs.envFile }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -59,7 +59,7 @@ jobs:
           CAPROVER_IMAGE_NAME: ${{ inputs.caproverImageName }}
           CAPROVER_APP: ${{ inputs.caproverAppName }}
 
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         if: ${{ inputs.discordWebhook }}
         with:
           webhook: ${{ inputs.discordWebhook }}

.github/workflows/deploy-to-heroku.yml

@@ -43,13 +43,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3.3.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Heroku CLI
         if: ${{ env.ACT }}
         run: curl https://cli-assets.heroku.com/install-ubuntu.sh | sh
 
-      - uses: akhileshns/heroku-deploy@v3.12.13 # This is the action
+      - uses: akhileshns/heroku-deploy@1b080913896a5d6d44a18e9e208f8eb1fee9b0f7 # v3.15.15
         with:
           heroku_api_key: ${{secrets.HEROKU_API_KEY}}
           heroku_app_name: ${{ inputs.heroku_app_name }} # Must be unique in Heroku

.github/workflows/docker-build.yml

@@ -28,21 +28,21 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
-      - uses: cardinalby/export-env-action@2.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: cardinalby/export-env-action@4f48c4676cf6ed6f46e30899ee987ce695da7c80 # 2.2.3
         with:
           envFile: ${{ inputs.envFile }}
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.github-token }}
 
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/build-push-action@v4
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         env:
           baseImage: BASE_IMAGE=oven/bun:${{ env.BUN_VERSION || 'latest' }}-slim
         with:
@@ -53,7 +53,7 @@ jobs:
           cache-to: type=gha,mode=max
           tags: ${{ inputs.dockerImageTags }}
 
-      - uses: sarisia/actions-status-discord@v1
+      - uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         if: ${{ failure() && inputs.discordWebhook }}
         with:
           webhook: ${{ inputs.discordWebhook }}

.github/workflows/eas-build-local.yml

@@ -60,8 +60,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
       google_service_account_key_path:
         required: false
         type: string
@@ -98,31 +97,31 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ !inputs.checkout_ref }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ inputs.checkout_ref }}
         with:
           ref: ${{ inputs.checkout_ref }}
 
       # as required by expo 50
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: zulu
           java-version: ${{ inputs.java_version }}
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: ${{ inputs.package_manager == 'bun' }}
         with:
           bun-version: ${{ inputs.bun_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ inputs.package_manager != 'bun' }}
         with:
           node-version-file: .nvmrc
@@ -144,7 +143,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         id: expo-init
         with:
           # Your Expo username, for authentication.

.github/workflows/eas-build.yml

@@ -60,8 +60,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
       nodeModulePaths:
         required: false
         type: string
@@ -106,25 +105,25 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ !inputs.checkout_ref }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: ${{ inputs.checkout_ref }}
         with:
           ref: ${{ inputs.checkout_ref }}
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         if: ${{ inputs.package_manager == 'bun' }}
         with:
           bun-version: ${{ inputs.bun_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ inputs.package_manager != 'bun' }}
         with:
           node-version-file: .nvmrc
@@ -146,7 +145,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         id: expo-init
         with:
           # Your Expo username, for authentication.

.github/workflows/expo-preview.yml

@@ -37,8 +37,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
     secrets:
       EXPO_TOKEN:
         required: true
@@ -59,14 +58,14 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager }}
@@ -87,7 +86,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           # Your Expo username, for authentication.
           token: ${{ secrets.EXPO_TOKEN }}
@@ -98,7 +97,7 @@ jobs:
 
       - name: Find Metro cache
         id: metro-cache-dir-path
-        uses: actions/github-script@v4
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           result-encoding: string
           script: |
@@ -107,7 +106,7 @@ jobs:
             return path.join(os.tmpdir(), 'metro-cache');
 
       - name: Restore Metro cache
-        uses: actions/cache@v2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ${{ steps.metro-cache-dir-path.outputs.result }}
           key: ${{ runner.os }}-metro-cache-${{ matrix.app }}-${{ github.ref }}
@@ -123,7 +122,7 @@ jobs:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_DEPLOY_ENV: ${{ inputs.expo_release_channel }}
 
-      - uses: marocchino/sticky-pull-request-comment@v2
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         with:
           recreate: true
           message: |

.github/workflows/expo-publish.yml

@@ -28,8 +28,7 @@ on:
       pnpm_version:
         required: false
         type: string
-        default: "8"
-        description: If using pnpm - which version to use
+        description: If using pnpm - which version to use (defaults to the packageManager field in package.json)
     secrets:
       EXPO_TOKEN:
         description: The Expo token to use for publishing
@@ -51,15 +50,15 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         id: checkout
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         if: ${{ inputs.package_manager == 'pnpm' }}
         with:
           version: ${{ inputs.pnpm_version }}
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .nvmrc
           cache: ${{ inputs.package_manager }}
@@ -80,7 +79,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
 
       - name: Expo GitHub Action
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         id: expo-init
         with:
           # Your Expo username, for authentication.
@@ -92,7 +91,7 @@ jobs:
 
       - name: Find Metro cache
         id: metro-cache-dir-path
-        uses: actions/github-script@v4
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           result-encoding: string
           script: |
@@ -101,7 +100,7 @@ jobs:
             return path.join(os.tmpdir(), 'metro-cache');
 
       - name: Restore Metro cache
-        uses: actions/cache@v2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ${{ steps.metro-cache-dir-path.outputs.result }}
           key: ${{ runner.os }}-metro-cache-${{ matrix.app }}-${{ github.ref }}