Gha uses shas

.github/workflows/build-deploy-on-release.yaml

@@ -1,32 +1,28 @@
 name: Deploy release
-
 on:
   release:
-    types: [ released ]
-
+    types: [released]
 jobs:
   build-production:
     name: Build production ${{ github.event.release.tag_name }}
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-production.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-production.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image_name: ${{ vars.IMAGE_NAME }}
       tag: ${{ github.event.release.tag_name }}
       dockerfile: Dockerfile
     secrets: inherit
-
   deploy-production-default:
     needs: build-production
     name: Deploy to production - default
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
       file: environments/default/production/app-image.txt
     secrets: inherit
-
   deploy-production-hathifiles:
     needs: build-production
     name: Deploy to production - hathifiles
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
       file: environments/hathifiles/production/app-image.txt

.github/workflows/build-main.yml

@@ -1,34 +1,30 @@
 name: Docker Build Main and Deploy to Workshop
-
 on:
   workflow_run:
-    workflows: [ 'Run Tests' ]
-    branches: [ main ]
-    types: [ completed ]
-
+    workflows: ['Run Tests']
+    branches: [main]
+    types: [completed]
 jobs:
   build-unstable:
     name: Build unstable ${{ github.sha }}
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image_name: ${{ vars.IMAGE_NAME }}
       tag: ${{ github.sha }}
       dockerfile: Dockerfile
     secrets: inherit
-
   deploy-workshop-default:
     needs: build-unstable
     name: Deploy to workshop - default
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ${{ needs.build-unstable.outputs.image }}
       file: environments/default/workshop/app-image.txt
     secrets: inherit
-
   deploy-workshop-hathifiles:
     needs: build-unstable
     name: Deploy to workshop - hathifiles
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ${{ needs.build-unstable.outputs.image }}
       file: environments/hathifiles/workshop/app-image.txt

.github/workflows/build-unstable.yaml

@@ -1,15 +1,13 @@
 name: Build unstable image
-
 on:
   workflow_dispatch:
     inputs:
       tag:
         description: tag
         required: true
-
 jobs:
   build-unstable:
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image_name: ${{ vars.IMAGE_NAME }}
       tag: ${{ github.event.inputs.tag }}

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: Continuous integration
+on:
+  push:
+  pull_request:
+permissions:
+  contents: write
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Create .env file
+        run: cat env.example env.development > .env
+      - name: Load .env file
+        uses: xom9ikk/dotenv@ac290ca23a42155a0cba1031d23afa46240116a9 # v2.3.0
+      - name: Set up Ruby 4.0
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
+        with:
+          ruby-version: 4.0
+          bundler-cache: true
+      - name: Run linter for Ruby
+        run: bundle exec standardrb
+      - name: Run tests
+        run: bundle exec rspec
+  dependabot:
+    name: 'Dependabot'
+    needs: [test]
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
+    steps:
+      - name: Fetch Dependabot Metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+      - name: Enable auto-merge for Dependabot PRs
+        # Don't do this for the container-updates group
+        if: ${{ steps.dependabot-metadata.outputs.dependency-group != 'container-updates' }}
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/manual-deploy-production.yaml

@@ -1,35 +1,30 @@
 name: Manual Deploy to Production
-
 on:
   workflow_dispatch:
     inputs:
       tag:
         description: tag
         required: true
-
-
 jobs:
   build-production:
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-production.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-production.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image_name: ${{ vars.IMAGE_NAME }}
       tag: ${{ github.event.inputs.tag }}
       dockerfile: Dockerfile
     secrets: inherit
-
   deploy-production-default:
     needs: build-production
     name: Deploy to production - default
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.inputs.tag }}
       file: environments/default/production/app-image.txt
     secrets: inherit
-
   deploy-production-hathifiles:
     needs: build-production
     name: Deploy to production - hathifiles
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.inputs.tag }}
       file: environments/hathifiles/production/app-image.txt

.github/workflows/manual-deploy-workshop.yaml

@@ -1,34 +1,30 @@
 name: Manual Deploy to Workshop
-
 on:
   workflow_dispatch:
     inputs:
       tag:
         description: tag
         required: true
-
 jobs:
   build-unstable:
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image_name: ${{ vars.IMAGE_NAME }}
       tag: ${{ github.event.inputs.tag }}
       dockerfile: Dockerfile
     secrets: inherit
-
   deploy-workshop-default:
     needs: build-unstable
     name: Deploy to workshop - default
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ${{ needs.build-unstable.outputs.image }}
       file: environments/default/workshop/app-image.txt
     secrets: inherit
-
   deploy-workshop-hathifiles:
     needs: build-unstable
     name: Deploy to workshop - hathifiles
-    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
+    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@2012bb6a322ad02c45c01372de2f5e2e3d7329ac # v1.6.7
     with:
       image: ${{ needs.build-unstable.outputs.image }}
       file: environments/hathifiles/workshop/app-image.txt

.github/workflows/tests.yml

@@ -1,16 +1,16 @@
-name: Run Tests
+name: Continuous Integration
 on: push
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Create .env file
         run: cat env.example env.development > .env
       - name: Load .env file
-        uses: xom9ikk/dotenv@v2
+        uses: xom9ikk/dotenv@ac290ca23a42155a0cba1031d23afa46240116a9 # v2.3.0
       - name: Set up Ruby 4.0
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
         with:
           ruby-version: 4.0
           bundler-cache: true