Add config for dependabot; bump/clean up gh actions

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  # Python dependencies. Dependabot discovers pyproject.toml and the
+  # pip-compile-generated requirements-lock.txt in this directory and
+  # auto-selects the pip-compile resolver.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Third-party actions referenced by workflow "uses:" pins.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/bigquery_dry_run.yml

@@ -17,7 +17,7 @@ jobs:
         id-token: 'write'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - id: 'auth'
         uses: 'google-github-actions/auth@v2'

.github/workflows/lint_sqlfluff.yml

@@ -9,27 +9,24 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          # Full history so we can diff the PR branch against its base
+          fetch-depth: 0
       - name: Install Python
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
       - name: install sqlfluff
         run: "pip install sqlfluff==4.1.0"
-      - name: Get changed files
-        id: get_file_changes
-        uses: trilom/file-changes-action@v1.2.4
-        with:
-          output: ' '
       - name: Get changed .sql files in mimic-iv concepts folder
         id: get_files_to_lint
         shell: bash
         run: |
-          # Compose list of changed SQL files under mimic-iv/concepts and export to step output
-          raw="${{ steps.get_file_changes.outputs.files_modified }} ${{ steps.get_file_changes.outputs.files_added }}"
-          # Check for mimic-iv SQL files which may have changed
-          filtered="$(printf '%s' "$raw" | tr -s ' ' '\n' | grep -E '^mimic-iv/concepts/.*[.]sql$' || true)"
-          # Turn this into a space separated list for the next step
-          files="$(printf '%s' "$filtered" | tr -s '\n' ' ')"
+          # Added/modified (--diff-filter=AM) SQL files on the PR branch since
+          # it diverged from the base branch, restricted to mimic-iv/concepts.
+          files="$(git diff --name-only --diff-filter=AM \
+            "origin/${{ github.base_ref }}...HEAD" -- 'mimic-iv/concepts/' \
+            | grep -E '[.]sql$' | tr '\n' ' ' || true)"
           echo "lintees=${files}" >> "$GITHUB_OUTPUT"
 
       - name: Lint SQL files

.github/workflows/main.yml

@@ -15,7 +15,7 @@ jobs:
         id-token: 'write'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - id: 'auth'
         uses: 'google-github-actions/auth@v2'

.github/workflows/mysql.yml

@@ -11,13 +11,10 @@ jobs:
 
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Download demo data
         uses: ./.github/actions/download-demo
-        with:
-            gcp-project-id: ${{ secrets.GCP_PROJECT_ID }}
-            gcp-sa-key: ${{ secrets.GCP_SA_KEY }}
 
       - name: Extract demo data to local folder
         run: |

.github/workflows/prerelease_bigquery.yml

@@ -14,7 +14,7 @@ jobs:
         id-token: 'write'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - id: 'auth'
         uses: 'google-github-actions/auth@v2'

.github/workflows/sqlite.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Python dependencies
         run: |