[Jasonvdb]

Pins every third-party GitHub Action in our workflows to a full commit SHA, and adds Dependabot to keep those pins current.

Description

• Every uses: in .github/workflows/ now points at a commit SHA with the release it came from as a comment (@<sha> # v4.4.0). A tag like @v4 can be moved by whoever controls the upstream repo; a SHA can't. This matters most for gradle-publish.yml, which runs with contents: write and packages: write and publishes bitkit-core-android.
• Nothing is upgraded. Each SHA is the commit the old tag pointed to when this branch was made, so behaviour is unchanged, and each one was checked against the upstream tag with git ls-remote. Since then anthropics/claude-code-action's v1 has moved one release ahead (v1.0.272, docs and tests only); Dependabot will offer that bump.
• dtolnay/rust-toolchain@stable was a branch, not a tag. It is now pinned to its v1 tag with toolchain: stable passed explicitly, which installs the same toolchain. (At the v1 commit the toolchain input is required; the stable branch only adds that default.)
• Adds .github/dependabot.yml for the github-actions ecosystem, modelled on bitkit-android's: weekly, minor and patch bumps grouped in one PR, each major in its own PR, and a 7-day cooldown so a freshly published release isn't proposed straight away.
• None of the actions pull in other actions through a mutable ref, with one exception that this PR doesn't change: claude-code-review.yml loads its review plugin from the anthropics/claude-code marketplace at its current default branch.

Follow-ups, not in this PR:

• Turn on the repository setting that requires actions to be pinned to a full-length commit SHA, so a new unpinned uses: fails instead of slipping in.
• Align workflows that use different majors of the same action (for example actions/checkout v4, v6 and v7).

Preview

No UI change.

QA Notes

• Every workflow and dependabot.yml parse as YAML.
• Every uses: line is pinned to a 40-character SHA, and each SHA matches the tag in its comment upstream (14 distinct pins).
• Only uses: lines changed in the workflows, plus the toolchain: stable input next to dtolnay/rust-toolchain.
• PR CI: the bindgen, validation, USDT, wake and Paykit route workflows run on this PR and exercise most of the new pins.
• gradle-publish.yml, claude.yml and claude-code-review.yml only run on release or manual dispatch, so their pins are checked statically above; the next release run exercises the publish workflow.

[coreyphillips]

Two independent reviews, nothing blocking a merge.

[talosmachina]

No findings. Pins every action in .github/workflows/ to a commit SHA with its release in a comment, and adds Dependabot for github-actions. Reviewed 0a1e673, full tier (CI workflows).

What I checked, and 3 candidates I ruled out

Read: every changed uses: line in the 9 workflows, and .github/dependabot.yml. No uses: is left unpinned at the head.

Build: not built. The change is workflow-only, and a Bitkit-track auto review does not run the PR's code here. CI is green on every PR-triggered workflow.

Pins checked upstream with git ls-remote, peeling annotated tags:

• All 14 distinct pins match the tag in their comment.
• 12 of the 14 also equal what the old uses: ref resolves to today. The other two are claude-code-action and rust-toolchain, both covered below.

Ruled out

• anthropics/claude-code-action@v1 now points past the pin: v1 is at v1.0.272 (d5f7970), while the pin is v1.0.271 (4fa93a8). The one commit between them touches only .github/workflows/test-structured-output.yml, docs/usage.md, examples/ and a test, nothing the action runs. Behaviour is the same, but the body's "each SHA is exactly what the old tag points to today" no longer holds for this one.
• rust-toolchain behaves differently at v1: the only difference between the stable branch (b725eda) and v1 (683b588) is action.yml making toolchain optional with default stable. Every pinned use, in all 6 workflows that use it, passes toolchain: stable.
• Dependabot groups swallow majors: the group is limited to minor and patch update types, so each major gets its own PR, as the body says.

Merge confidence: 4/5. gradle-publish.yml, claude.yml and claude-code-review.yml only run on release or dispatch, so no CI run covers their new pins.

[Jasonvdb]

@talosmachina thanks for checking the pins. You're right that claude-code-action's v1 has moved one docs-only release past the pin since I made the branch, so I've reworded that line in the description. I've left the pin as it is; Dependabot will pick up the new release.

[ovi-reviewer]

Verdict: ✅ Approve

Findings: None.

Full review of 2210649…0a1e673, all 10 changed files.

QA for 0a1e673:

Check: Workflow and Dependabot configuration parses ✅ All ten YAML files parse, and actionlint accepts all nine workflows.

Checked with PyYAML and actionlint 1.7.12.

Check: Action pins preserve the workflow configuration ✅ All 14 unique pins match their upstream release tags.

All 36 action references use full commit SHAs. Comparing parsed workflows with the base confirms the only other change is explicit toolchain: stable at all six Rust setup steps, preserving existing components. The pinned Rust action accepts those inputs. Dependabot's directory, grouping and cooldown match the documented options.

Check: Pull request workflows complete successfully ✅ All six PR-triggered workflows and the Dependabot configuration check succeeded at this head.

Verified the reported results of:

• Android Bindgen.
• iOS Bindgen.
• Bindgen Validation.
• USDT Tests.
• Wake Tests.
• Paykit Route Tests.

No application build or device run: this workflow-only diff changes no application behavior and specifies no device QA cases. gradle-publish.yml, claude.yml and claude-code-review.yml were checked statically; release publishing and manual dispatch were not exercised.

Also read the earlier review at this head and the author's clarification about the floating Claude action tag.

---

Reviewed by gpt-6.1-sol-high

[ovitrif]

utAck