From d30355180237276c9d63c7d8df4e28a1bda194c3 Mon Sep 17 00:00:00 2001
From: murashit <murashit@proton.me>
Date: Fri, 29 May 2026 13:14:19 +0900
Subject: [PATCH] Harden GitHub Actions configuration

---
 .github/dependabot.yml        |  4 ++++
 .github/workflows/check.yml   |  8 +++++---
 .github/workflows/release.yml | 12 +++++++-----
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d7f37bf2..19453d07 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,11 +4,15 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     groups:
       dev-dependencies:
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 6e0da5ae..3c96e63c 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -16,16 +16,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: npm
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Check
         run: npm run check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 36061cdf..039d0ba6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,16 +17,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
-          cache: npm
+          package-manager-cache: false
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Check release version
         run: npm run release:check
@@ -37,7 +39,7 @@ jobs:
         run: npm run check
 
       - name: Generate artifact attestations
-        uses: actions/attest@v4
+        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
         with:
           subject-path: |
             main.js