Add a workflow vulnerability scanner

.github/dependabot.yml

@@ -4,3 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/benchmark-impl.yml

@@ -58,19 +58,20 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ inputs.ref }}
+          persist-credentials: false
       - name: Set up python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Set up poetry
-        uses: hpcflow/github-support/setup-poetry@0.5
+        uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
         with:
           version: ${{ inputs.poetry-version }}
       - name: Cache dependencies
-        uses: hpcflow/github-support/init-cache@0.5
+        uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
         with:
           name: benchmark
           version: ${{ matrix.python-version }}
@@ -82,12 +83,15 @@ jobs:
       - name: Set up variables
         id: vars
         run: |
-          echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
+          echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
         shell: bash
+        env:
+          N_ELEMS: ${{ matrix.num_elements }}
+          PY_VER: ${{ matrix.python-version }}
 
       - name: Run app make workflow command
         run: |
-          poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
+          poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
         env:
           EXECUTABLE: ${{ inputs.executable_name }}
           BENCHMARK: ${{ inputs.benchmark_make_workflow }}
@@ -96,7 +100,7 @@ jobs:
         shell: bash
 
       - name: Store benchmark file
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.vars.outputs.timeit }}
           path: ${{ steps.vars.outputs.timeit }}
@@ -112,17 +116,17 @@ jobs:
         run: |
           mkdir benchmarks
       - name: Fetch benchmark data
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true
           path: benchmarks
       - name: Delete partial benchmark data
-        uses: geekyeggo/delete-artifact@v6
+        uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
         with:
           name: "*"
           failOnError: false
       - name: Store benchmark data archive
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: upload
         with:
           name: benchmarks

.github/workflows/doc-build-impl.yml

@@ -85,42 +85,48 @@ jobs:
       artifact-url: ${{ steps.upload.outputs.artifact-url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ inputs.ref }}
+          persist-credentials: false
       - name: Checkout support code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: hpcflow/github-support
           path: github-support
           ref: ${{ inputs.script-branch }}
+          persist-credentials: false
       - name: Init Python ${{ inputs.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ inputs.python-version }}
       - name: Install and configure poetry ${{ inputs.poetry-version }}
-        uses: hpcflow/github-support/setup-poetry@0.5
+        uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
         with:
           version: ${{ inputs.poetry-version }}
       - name: Cache Virtual Environment
-        uses: hpcflow/github-support/init-cache@0.5
+        uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
         with:
           name: sphinx
           version: ${{ inputs.python-version }}
       - name: Install Dependencies
         run: |
-          poetry install ${{ inputs.install-args }}
+          poetry install $Args
+        env:
+          Args: ${{ inputs.install-args }}
       - name: Configure Problem Matcher
         run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
         # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
         # See: https://github.com/python/cpython/pull/20325
       - name: Run Sphinx
         run: |
-          poetry run make clean html ${{ inputs.sphinx-args }}
+          poetry run make clean html $Args
+        env:
+          Args: ${{ inputs.sphinx-args }}
         working-directory: docs
       - name: Upload documentation artifact
         id: upload
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
           path: docs/build/html
@@ -146,17 +152,17 @@ jobs:
       page-url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Download documentation artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: site
           merge-multiple: true
       - name: Setup GitHub Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Upload artifact to documentation staging
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           # Upload dist repository
           path: site
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0