Revise dependabot.yml and pin GitHub Actions.

.github/dependabot.yml

@@ -1,30 +1,19 @@
 version: 2
 updates:
-  - package-ecosystem: github-actions
-    directory: /
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: monthly
+      interval: 'monthly'
     groups:
-      actions-minor:
-        update-types:
-          - minor
-          - patch
+      github-actions-updates:
+        patterns:
+          - '*'
 
-  - package-ecosystem: npm
-    directory: /
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: monthly
-    ignore:
-      - dependency-name: '@types/node'
-        update-types:
-          - 'version-update:semver-major'
+      interval: 'monthly'
     groups:
-      npm-development:
-        dependency-type: development
-        update-types:
-          - minor
-          - patch
-      npm-production:
-        dependency-type: production
-        update-types:
-          - patch
+      npm-updates:
+        patterns:
+          - '*'

.github/workflows/check-dist.yml

@@ -32,11 +32,11 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: .node-version
           cache: npm
@@ -70,7 +70,7 @@ jobs:
       - if: ${{ failure() && steps.diff.outcome == 'failure' }}
         name: Upload Artifact
         id: upload
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dist
           path: dist/

.github/workflows/ci.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: .node-version
           cache: npm
@@ -83,7 +83,7 @@ jobs:
             os: ubuntu-latest
             set-gds-token: true
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -151,7 +151,7 @@ jobs:
             components: 'native-image'
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -208,7 +208,7 @@ jobs:
             components: 'native-image'
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -257,7 +257,7 @@ jobs:
             distribution: 'mandrel'
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -292,7 +292,7 @@ jobs:
         java-package: ['', 'jdk', 'jdk+fx']
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -332,7 +332,7 @@ jobs:
       contents: read
       pull-requests: write # for `native-image-pr-reports` option
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -355,7 +355,7 @@ jobs:
       contents: read
       pull-requests: write # for `native-image-pr-reports` option
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -378,7 +378,7 @@ jobs:
       contents: read
       pull-requests: write # for `native-image-pr-reports` option
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -402,7 +402,7 @@ jobs:
       contents: read
       pull-requests: write # for `native-image-pr-reports` option
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with:
@@ -463,7 +463,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest, ubuntu-22.04-arm]
         components: ['']
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run setup-graalvm action
         uses: ./
         with: