Update dependencies

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+updates:
+  # Go modules (go.mod / go.sum) — Hugo module dependencies
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      # Keep the Hextra theme module and any imfing-published companions together
+      imfing:
+        patterns:
+          - "github.com/imfing/*"
+
+  # Dev Container image and features (.devcontainer/devcontainer.json)
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      # Coordinate the devcontainers org's base features as one PR
+      devcontainers-features:
+        patterns:
+          - "ghcr.io/devcontainers/*"
+
+  # GitHub Actions used across .github/workflows/*
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      # Roll all action bumps into a single PR to cut noise
+      actions:
+        patterns:
+          - "*"

.github/workflows/build-pr.yml

@@ -42,7 +42,7 @@ jobs:
           echo "true" > ./metadata/PRIVILEGED
 
       - name: Upload metadata as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: metadata
           path: metadata
@@ -62,7 +62,7 @@ jobs:
     needs: build_english
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: site-build.tar.gz
           merge-multiple: true
@@ -72,7 +72,7 @@ jobs:
           ls -la public/
 
       - name: Upload Site
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: site-build-combined
           path: public

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Download Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
@@ -34,7 +34,7 @@ jobs:
           submodules: recursive
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1
         with:
           hugo-version: 'latest'
 
@@ -47,7 +47,7 @@ jobs:
           tar -czf site-build.tar.gz public
 
       - name: Upload Site
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: site-build.tar.gz
           path: site-build.tar.gz

.github/workflows/publish-pr.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Download Website Build Artifact
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -53,14 +53,14 @@ jobs:
           tar -czvf site-build-combined.tar.gz site
 
       - name: Upload Combined Build Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: site-build-combined.tar.gz
           path: site-build-combined.tar.gz
           retention-days: 5
 
       - name: Download Metadata Artifact
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -97,7 +97,7 @@ jobs:
     outputs:
       address: ${{ steps.deployment.outputs.address }}
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: site-build-combined.tar.gz
           merge-multiple: true
@@ -109,7 +109,7 @@ jobs:
       - name: Limit length of site alias to 12
         run: echo "SHORT_ALIAS=$(echo "${{ needs.metadata.outputs.pr_number }}" | cut -c1-12)" >> "$GITHUB_ENV"
 
-      - uses: hkdobrev/minio-deploy-action@v1
+      - uses: hkdobrev/minio-deploy-action@98438a5d45068824d87fc8938095ae86dabc05bd # v1.1.0
         with:
           endpoint: https://${{ vars.PREVIEW_GARAGE_HOSTNAME }}
           bucket:  ${{ vars.PREVIEW_GARAGE_BUCKET }}
@@ -130,7 +130,7 @@ jobs:
     env:
       address: ${{ needs.deploy_garage.outputs.address }}
     steps:
-      - uses: thollander/actions-comment-pull-request@v2.5.0
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
         with:
           pr_number: ${{ needs.metadata.outputs.pr_number }}
           message: |

.gitignore

@@ -3,3 +3,4 @@ public/
 resources/
 .hugo_build.lock
 /scripts
+.cache