Dependabot nowadays updates GH action version number if one is included as a comment. That would be useful.
So in all actions in .github/workflows/*.yml instead of using
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
we should use:
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
Fixing all uses lines does not have to happen in a single PR