improve workflows

[till]

Purpose (TL;DR) - mandatory

This PR adds a couple improvements for the current workflows:

• pin each action to a sha; see: https://docs.zizmor.sh/audits/#unpinned-uses
• avoid splunging the creds; see: https://docs.zizmor.sh/audits/#artipacked
• fixes a small issue with fetch-depth (on the wrong action)
• adds a new job to validate it going forward
• for dependabot:
  • group github action updates into one pr
  • add cooldown (new releases need to marinate a little before dependabot suggests them); see: https://docs.zizmor.sh/audits/#dependabot-cooldown

zizmor

zizmor is a neat tool enforce best practices for workflows, if there were any findings, it would creating security annotations via "github advanced security" (which is what the comment is about).

How to verify - mandatory

Approve the workflows, they should continue to run.

Checklist for author

• npm run lint passes
• References to standard library functions are cached.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[fatso83]

Hi, commit specific commits seem a bit scary, TBH. I could live with specific versions, but maybe leave it at a specific tagged version?

feedback calmed my nerves

[fatso83]

Thank you!

[fatso83]

@till Could you guide me on what to do with this dependency update PR?