chore: Improve workflow security

- Add dependency checking with dependabot.
- Put more specific version locks for actions.
- Upgrade actions which were using Node 16 actions.

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: mix
+    directory: /elixir
+    schedule:
+      interval: weekly

.github/github_workflows.ex

@@ -211,7 +211,10 @@ defmodule GithubWorkflows do
       steps: [
         checkout_step(),
         [
-          uses: "superfly/flyctl-actions/setup-flyctl@master"
+          uses: "superfly/flyctl-actions/[email protected]",
+          with: [
+            version: "0.3.60"
+          ]
         ],
         [
           run: "flyctl deploy --remote-only",
@@ -242,7 +245,7 @@ defmodule GithubWorkflows do
       steps: [
         [
           name: "Restore PLT cache",
-          uses: "actions/cache/restore@v4",
+          uses: "actions/cache/restore@v4.1.2",
           with: cache_opts(@plt_cache_key_prefix, @plt_cache_path)
         ],
         [
@@ -277,15 +280,15 @@ defmodule GithubWorkflows do
           [
             id: "setup-beam",
             name: "Set up Elixir",
-            uses: "erlef/setup-beam@v1",
+            uses: "erlef/setup-beam@v1.18.2",
             with: [
               "version-file": ".tool-versions",
               "version-type": "strict"
             ]
           ],
           [
             name: "Restore dependencies cache",
-            uses: "actions/cache/restore@v4",
+            uses: "actions/cache/restore@v4.1.2",
             with: cache_opts(@mix_cache_key_prefix, @mix_cache_path)
           ]
         ] ++ steps
@@ -332,7 +335,7 @@ defmodule GithubWorkflows do
         checkout_step(),
         [
           name: "Restore npm cache",
-          uses: "actions/cache/restore@v4",
+          uses: "actions/cache/restore@v4.1.2",
           id: "npm-cache",
           with: [
             path: "node_modules",
@@ -417,7 +420,7 @@ defmodule GithubWorkflows do
           checkout_step(),
           [
             name: "Restore script result cache",
-            uses: "actions/cache/restore@v4",
+            uses: "actions/cache/restore@v4.1.2",
             id: "result_cache",
             with: [
               key:
@@ -472,7 +475,7 @@ defmodule GithubWorkflows do
             [
               name: "Check HTTP status code",
               if: "steps.result_cache.outputs.cache-hit != 'true'",
-              uses: "nick-fields/retry@v2",
+              uses: "nick-fields/retry@v3.0.0",
               with: [
                 command:
                   "INPUT_SITES='[\"http://localhost:4000\"]' INPUT_EXPECTED='[200]' ./test/scripts/check_status_code.sh",
@@ -531,7 +534,7 @@ defmodule GithubWorkflows do
   defp checkout_step do
     [
       name: "Checkout",
-      uses: "actions/checkout@v4"
+      uses: "actions/checkout@v4.2.2"
     ]
   end