ci: pin actions, refresh dependencies, and improve Dependabot config

.github/dependabot.yaml

@@ -1,12 +1,18 @@
 version: 2
 updates:
   - package-ecosystem: "cargo"
-    directory: "/"
+    directories: ["**/*"]
+    groups:
+      # Create one repo-wide PR per Cargo dependency name,
+      # combining all its manifest and lockfile updates.
+      per-dependency:
+        group-by: dependency-name
     schedule:
       interval: "weekly"
-      day: "wednesday"
-      timezone: "America/Los_Angeles"
-      time: "06:00"
+      day: "tuesday"
+      timezone: "Etc/UTC"
+      time: "23:00"
+    open-pull-requests-limit: 10
     commit-message:
       prefix: "chore"
     labels:
@@ -15,13 +21,25 @@ updates:
 
   - package-ecosystem: "github-actions"
     directory: "/"
+    groups:
+      # Combine minor and patch updates for all actions into one PR.
+      # Leave major upgrades ungrouped for individual review.
+      actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
     schedule:
       interval: "weekly"
-      day: "wednesday"
-      timezone: "America/Los_Angeles"
-      time: "06:00"
+      day: "thursday"
+      timezone: "Etc/UTC"
+      time: "23:00"
+    open-pull-requests-limit: 10
     commit-message:
       prefix: "chore"
     labels:
       - "type:dependabot"
       - "type:dependencies-github-actions"
+    cooldown:
+      default-days: 7

.github/workflows/build.yaml

@@ -56,10 +56,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout windows-drivers-rs actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: microsoft/windows-drivers-rs
           ref: main
@@ -92,7 +92,7 @@ jobs:
           target: ${{ matrix.wdk.source == 'nuget' && matrix.target_triple.arch || '' }}
 
       - name: Install Rust Toolchain (${{ matrix.rust_toolchain }})
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: ${{ matrix.rust_toolchain }}
           targets: ${{ matrix.target_triple.name }}

.github/workflows/cargo-audit.yaml

@@ -24,9 +24,9 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Cargo Audit
-        uses: rustsec/audit-check@v1
+        uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/code-formatting-check.yaml

@@ -18,11 +18,12 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust Toolchain (Nightly)
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
+          toolchain: nightly
           components: rustfmt
 
       - name: Run Cargo Format
@@ -34,16 +35,18 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust Toolchain (Stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+        with:
+          toolchain: stable
 
       # Using cache-cargo-install-action to cache the compiled binary.
       # Once taplo ships a release with field-level `keys` matching, this can
       # be simplified back to install-action with a normal version pin.
       - name: Install taplo-cli from pinned revision b673b44d
-        uses: taiki-e/cache-cargo-install-action@v3
+        uses: taiki-e/cache-cargo-install-action@9ee83daaa7b96a6fab930949ecf1122bba04a389 # v3.0.8
         with:
           tool: taplo-cli
           git: https://github.com/tamasfe/taplo

.github/workflows/docs.yaml

@@ -54,10 +54,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout windows-drivers-rs actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: microsoft/windows-drivers-rs
           ref: main
@@ -90,7 +90,7 @@ jobs:
           target: ${{ matrix.wdk.source == 'nuget' && matrix.target_triple.arch || '' }}
 
       - name: Install Rust Toolchain (${{ matrix.rust_toolchain }})
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: ${{ matrix.rust_toolchain }}
           targets: ${{ matrix.target_triple.name }}

.github/workflows/github-dependency-review.yaml

@@ -19,19 +19,18 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           allow-licenses: >-
             MIT,
             Apache-2.0,
             BSD-3-Clause,
             ISC,
-            Unicode-DFS-2016
-          # anstyle@1.0.4 is licensed as (MIT OR Apache-2.0), but the Github api fails to detect it: https://github.com/rust-cli/anstyle/tree/main/crates/anstyle
-          allow-dependencies-licenses: 'pkg:cargo/anstyle@1.0.4'
+            Unicode-DFS-2016,
+            Unicode-3.0
           comment-summary-in-pr: on-failure
           # Explicit refs required for merge_group and push triggers:
           # https://github.com/actions/dependency-review-action/issues/456

.github/workflows/lint.yaml

@@ -52,10 +52,10 @@ jobs:
     runs-on: ${{ matrix.runner.name }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout windows-drivers-rs actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: microsoft/windows-drivers-rs
           ref: main
@@ -88,7 +88,7 @@ jobs:
           target: ${{ matrix.wdk.source == 'nuget' && matrix.target_triple.arch || '' }}
 
       - name: Install Rust Toolchain (${{ matrix.rust_toolchain }})
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: ${{ matrix.rust_toolchain }}
           components: clippy
@@ -110,10 +110,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout windows-drivers-rs actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: microsoft/windows-drivers-rs
           ref: main
@@ -127,7 +127,9 @@ jobs:
         run: Copy-Item -Recurse -Force _temp/windows-drivers-rs/.github/actions .github/
 
       - name: Install Rust Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+        with:
+          toolchain: stable
 
       - name: Install Cargo Machete
         uses: ./.github/actions/install-cargo-tool