Pin GHA versions and add dependabot (#189)

pin gha versions and add dependabot

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: daily

.github/workflows/configure.yml

@@ -10,8 +10,8 @@ jobs:
     name: Configure
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@1.0.0
-      - uses: micnncim/action-label-syncer@v1
+      - uses: actions/checkout@v3
+      - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}

.github/workflows/fmt.yml

@@ -5,5 +5,5 @@ jobs:
     name: Check Formatting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: dprint/check@v2.0
+      - uses: actions/checkout@v3
+      - uses: dprint/check@b8a69d368d232496f6e82dac8fb12044fe3147d6 # v2.1

.github/workflows/release.yml

@@ -8,15 +8,15 @@ jobs:
     name: Build & Publish to NPM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: denoland/setup-deno@v1
+      - uses: actions/checkout@v3
+      - uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e983317366 # v1.1.0
         with:
           deno-version: v1.x
       - name: Retrieve Version
         if: startsWith(github.ref, 'refs/tags/')
         id: get_tag_version
         run: echo ::set-output name=TAG_VERSION::${GITHUB_REF/refs\/tags\//}
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v3
         with:
           node-version: "16.x"
           registry-url: "https://registry.npmjs.org"

.github/workflows/spellcheck.yml

@@ -5,4 +5,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: streetsidesoftware/cspell-action@v2
+      - uses: streetsidesoftware/cspell-action@b88ea4a807ea2d641cebf2a52f667038015ad711 # v2.7.0

.github/workflows/test.yml

@@ -5,8 +5,8 @@ jobs:
     name: Run Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: denoland/setup-deno@v1
+      - uses: actions/checkout@v3
+      - uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e983317366 # v1.1.0
         with:
           deno-version: v1.x
       - run: deno task star

.github/workflows/udd.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: denoland/setup-deno@v1
+      - uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e983317366 # v1.1.0
         with:
           deno-version: 1.22.3
       - name: Update dependencies
@@ -23,7 +23,7 @@ jobs:
         run: |
           deno task test
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@18f90432bedd2afd6a825469ffd38aa24712a91d # v4.1.1
         id: pr
         with:
           commit-message: "update dependencies and regenerate lockfile"
@@ -38,14 +38,14 @@ jobs:
         run: |
           echo "::set-output name=sha::$(git rev-parse HEAD)"
       - name: Set commit status with pending
-        uses: Sibz/github-status-action@v1
+        uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
         with:
           authToken: ${{ secrets.GITHUB_TOKEN }}
           context: "Basic tests"
           state: "pending"
           sha: ${{ steps.commit.outputs.sha }}
       - name: Set commit status with outcome
-        uses: Sibz/github-status-action@v1
+        uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
         with:
           authToken: ${{ secrets.GITHUB_TOKEN }}
           context: "Basic tests"