From 675d0baac4953db9c09d53e96c6359f60b0f88f3 Mon Sep 17 00:00:00 2001
From: Vincent Langlet <vincentlanglet@hotmail.fr>
Date: Tue, 30 Jun 2026 14:51:37 +0200
Subject: [PATCH] Lock version and do not persist credentials

---
 .github/dependabot.yml        | 8 +++++++-
 .github/workflows/checks.yml  | 8 +++++---
 .github/workflows/publish.yml | 8 +++++---
 .gitignore                    | 1 +
 4 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c19e09b..047cd71 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,7 +4,13 @@ updates:
       directory: "/"
       schedule:
           interval: "weekly"
-      open-pull-requests-limit: 10
+      rebase-strategy: "auto"
+      open-pull-requests-limit: 3
+      groups:
+          minor-and-patch:
+               update-types:
+                   - "minor"
+                   - "patch"
 
     - package-ecosystem: "npm"
       directory: "/"
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 8930c08..21a4c7d 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -17,9 +17,11 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 10
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+              with:
+                  persist-credentials: false
 
-            - uses: actions/setup-node@v6
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version-file: ".nvmrc"
                   registry-url: https://npm.pkg.github.com/
@@ -34,7 +36,7 @@ jobs:
 
             - run: npm test
 
-            - uses: shivammathur/setup-php@v2
+            - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
               with:
                   php-version: 8.3
                   tools: composer:v2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d529fd9..f74f4e2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,9 +15,11 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 10
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+              with:
+                  persist-credentials: false
 
-            - uses: actions/setup-node@v6
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version-file: ".nvmrc"
                   registry-url: https://npm.pkg.github.com/
@@ -44,7 +46,7 @@ jobs:
                   --content-type 'image/svg+xml; charset=utf-8'
 
             - name: Cloudfront invalidations
-              uses: awact/cloudfront-action@master
+              uses: awact/cloudfront-action@092e61fd4cc49f3c27490d7774572ba02c836326 # master
               env:
                   SOURCE_PATH: "/flags/*"
                   DISTRIBUTION_ID: E246SQQF56C0KG
diff --git a/.gitignore b/.gitignore
index 8fa7c3a..31634e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .idea
 .DS_Store
+.claude/settings.local.json
 
 node_modules/
 vendor/