From 95457d8fb58f464c0c0241e767a1c8bfbd974f91 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 22:47:48 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/dependabot.yml                            | 12 ++++++++++++
 .github/workflows/chat.yaml                       |  8 ++++----
 .github/workflows/enforce-pr-jira-association.yml |  4 ++--
 .github/workflows/lua-format-check-pr.yml         |  8 ++++----
 4 files changed, 22 insertions(+), 10 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..a9c1b32f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      external-github-actions:
+          patterns:
+              - '*/*'
+          exclude-patterns:
+              - Tricentis*/*
diff --git a/.github/workflows/chat.yaml b/.github/workflows/chat.yaml
index acd07bcc..4b0b5f34 100644
--- a/.github/workflows/chat.yaml
+++ b/.github/workflows/chat.yaml
@@ -8,7 +8,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     strategy:
       matrix:
         target: [x86_64-unknown-linux-musl]
@@ -16,12 +16,12 @@ jobs:
     steps:
       - name: add gtk
         run: sudo apt-get install -y libgtk2.0-dev libglib2.0-dev
-      - uses: actions/checkout@v4
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7
         with:
           toolchain: 1.70.0
           target: ${{ matrix.target }}
-      - uses: ClementTsang/cargo-action@v0.0.3
+      - uses: ClementTsang/cargo-action@3a7eb8bd7347b80ca95ab635409efd17d12156c2 # v0.0.3
         with:
           command: build
           args: --release --target=${{ matrix.target }}
diff --git a/.github/workflows/enforce-pr-jira-association.yml b/.github/workflows/enforce-pr-jira-association.yml
index 62860bcf..bd3ac688 100644
--- a/.github/workflows/enforce-pr-jira-association.yml
+++ b/.github/workflows/enforce-pr-jira-association.yml
@@ -10,12 +10,12 @@ on:
 
 jobs:
   enforce-issue:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     name: JIRA Association
     steps:
       - name: Check for JIRA ISSUE
         id: check
-        uses: usehaystack/jira-pr-link-action@v4
+        uses: usehaystack/jira-pr-link-action@22aff45075226d8971865093c4c0473262f351ed # v4
         with:
           ignore-author: dependabot[bot]
           project: "DEV2"
diff --git a/.github/workflows/lua-format-check-pr.yml b/.github/workflows/lua-format-check-pr.yml
index b67a873e..bfc9e9b2 100644
--- a/.github/workflows/lua-format-check-pr.yml
+++ b/.github/workflows/lua-format-check-pr.yml
@@ -10,16 +10,16 @@ permissions:
   pull-requests: write
 jobs:
   format_code:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     steps:
-      - uses: actions/checkout@v4
-      - uses: JohnnyMorganz/stylua-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: JohnnyMorganz/stylua-action@479972f01e665acfcba96ada452c36608bdbbb5e # v4.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: latest
           args: .
       - name: suggester
-        uses: reviewdog/action-suggester@v1
+        uses: step-security/action-suggester@854bdfbbb12a23c87d847a6a435eb2e83453407e # v1.24.3
         with:
           tool_name: stylua
           fail_on_error: true