ci: pin third-party action SHAs and add Dependabot cooldown

.github/dependabot.yml

@@ -9,3 +9,6 @@ updates:
     directory: ".github/actions/core" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 14

.github/workflows/build-and-test.yml

@@ -2,8 +2,7 @@ name: Build & Test
 
 on:
   pull_request:
-    branches:
-      - main
+    branches: [main]
     types:
       - opened
       - synchronize
@@ -51,7 +50,7 @@ jobs:
       - name: Commit build artifacts (same-repo PRs only)
         if: github.event.pull_request.head.repo.full_name == github.repository
         id: commit_dist
-        uses: EndBug/add-and-commit@v10
+        uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10.0.0
         with:
           add: "."
           message: "chore: build core action dist (auto)"
@@ -216,7 +215,7 @@ jobs:
           fi
 
       - name: Set Commit Status
-        uses: myrotvorets/set-commit-status-action@master
+        uses: myrotvorets/set-commit-status-action@2c3557527522d8d38f410941902b64a4be75a0ec # master
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           status: ${{ steps.status.outputs.status }}

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@
 
 name: "CodeQL Advanced"
 
-on:
+on:  # zizmor: ignore[pull-request-target]
   push:
     branches: [main]
   pull_request:

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
 
             - name: Generate Changelog
               id: changelog
-              uses: mikepenz/release-changelog-builder-action@v6
+              uses: mikepenz/release-changelog-builder-action@348e88fab4c37338b1e803ceb2d4a7a5db6c0833 # v6
               with:
                   configuration: "configuration.json"
                   mode: "COMMIT"
@@ -171,7 +171,7 @@ jobs:
                   git push -f origin "v$MAJOR_VERSION"
 
             - name: Create Release
-              uses: softprops/action-gh-release@v3
+              uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
               with:
                   tag_name: "v${{ inputs.version }}"
                   name: "v${{ inputs.version }}"