security: Pin GitHub Actions to specific git revisions

[platform-change-automation]

Summary

This change improves our supply chain security by pinning all third-party GitHub Actions to specific git revisions using ratchet.

Why this matters

When GitHub Actions are referenced by mutable tags like @v3 or @main, the actual code being executed can change without notice. This creates security risks:

1. A compromised action could introduce malicious code
2. Breaking changes could be introduced unexpectedly
3. Build reproducibility is compromised

What changed

• All third-party GitHub Actions references now use immutable SHA references (@{sha}) instead of mutable tags
• Internal actions from the mdsol organization are preserved as-is (marked with # ratchet:exclude)
• The original tag is preserved as a comment using ratchet's annotation format: ratchet:{action}@{version}
• Future updates can be managed with ratchet update to get the latest SHA that matches your version constraint
• Added or updated Dependabot configuration to automatically open PRs for GitHub Actions updates on a weekly basis

Dependabot Integration

This change also configures Dependabot to automatically create pull requests when new versions of GitHub Actions become available:

• If a dependabot.yml or dependabot.yaml file already exists, it's updated to include GitHub Actions
• If no Dependabot configuration exists, one is created with weekly GitHub Actions updates
• Pull requests from Dependabot will contain the new SHA references, making it easy to keep actions up-to-date while maintaining the security benefits of pinning

Testing

This change does not modify the behavior of the workflows, only pins them to specific revisions. Workflows will continue to function as before, but with improved security and reproducibility.

References

• GitHub Security Best Practices: Supply chain
• Ratchet Documentation
• Dependabot Version Updates for GitHub Actions

---

This change was made automatically using the batch changes tool that @johnduhart is working on.
🔗 Changeset Specification