fix: github permissions

- [x] add permissions to tests workflow
- [x] update actions versions to latest
- [x] add github actions to dependabot updates
  - [x] group minor and patch versions into single PR
  - [x] prefix dependabot PRs with chore(deps)

Signed-off-by: jmeridth <jmeridth@gmail.com>

.github/dependabot.yml

@@ -3,10 +3,27 @@ updates:
   - package-ecosystem: npm
     directory: "/"
     schedule:
-      interval: daily
-      time: "10:00"
-      timezone: Europe/Vienna
-    pull-request-branch-name:
-      separator: "-"
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
     open-pull-requests-limit: 99
     rebase-strategy: disabled
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    open-pull-requests-limit: 99
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/tests.yml

@@ -5,22 +5,26 @@ on:
     branches:
       - main
   pull_request:
+
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Git repository
-        uses: actions/checkout@v1
+        uses: actions/checkout@v4.2.2
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@v1.202.0
 
       - name: Get NodeJS version
         run: echo "NODE_VERSION=$(cat .node-version)" >> $GITHUB_OUTPUT
         id: node_version
 
       - name: Set up NodeJS
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4.1.0
         with:
           node-version: "${{ steps.node_version.outputs.NODE_VERSION }}"
 

.gitignore

@@ -7,3 +7,4 @@ Brewfile.lock.json
 Gemfile.lock
 .jekyll-metadata
 .vscode
+.tool-versions