ci: harden GitHub Actions automation

Closes #9

Author: ubugeeei

.github/README.md

@@ -0,0 +1,12 @@
+# GitHub Automation
+
+## Workflows
+
+- Keep workflow jobs on explicit runner images, such as `ubuntu-24.04`, so CI changes are reviewed instead of inherited from moving aliases.
+- Keep third-party actions pinned to full commit SHAs. Preserve the upstream version comment next to each SHA so reviews can see the intended release line.
+- Keep workflow permissions scoped per job. Prefer top-level read-only permissions, or `permissions: {}` when every job declares its own permissions.
+- Keep `timeout-minutes` on each job to avoid stuck runners consuming the Actions queue.
+
+## Dependency Updates
+
+Dependabot checks GitHub Actions, Cargo crates, and npm packages weekly. For GitHub Actions updates, accept the Dependabot PR only after confirming the new commit SHA still belongs to the expected upstream release tag.

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:15"
+      timezone: Asia/Tokyo
+    groups:
+      rust-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: Asia/Tokyo
+    groups:
+      javascript-dependencies:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_dispatch:
   pull_request:
   push:
     branches:
@@ -9,16 +10,25 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    name: Verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    env:
+      RUST_TOOLCHAIN: 1.93.0
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Set up Vite+
-        uses: voidzero-dev/setup-vp@v1
+        uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1
         with:
           node-version: 22
           cache: true
@@ -27,14 +37,14 @@ jobs:
 
       - name: Install Rust toolchain
         run: |
-          rustup toolchain install stable --profile minimal --component clippy
-          rustup default stable
-          rustup target add wasm32-unknown-unknown
+          rustup toolchain install "$RUST_TOOLCHAIN" --profile minimal --component clippy
+          rustup default "$RUST_TOOLCHAIN"
+          rustup target add wasm32-unknown-unknown --toolchain "$RUST_TOOLCHAIN"
 
       - name: Install WebAssembly linker
         run: |
           sudo apt-get update
-          sudo apt-get install --yes lld
+          sudo apt-get install --no-install-recommends --yes lld
 
       - name: Run workspace CI
         run: vp run ci

.github/workflows/playground-pages.yml

@@ -6,29 +6,35 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  id-token: write
-  pages: write
+permissions: {}
 
 concurrency:
   group: playground-pages
   cancel-in-progress: true
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: Build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    permissions:
+      contents: read
+      pages: write
+
+    env:
+      RUST_TOOLCHAIN: 1.93.0
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Set up Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
 
       - name: Set up Vite+
-        uses: voidzero-dev/setup-vp@v1
+        uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1
         with:
           node-version: 22
           cache: true
@@ -37,33 +43,39 @@ jobs:
 
       - name: Install Rust toolchain
         run: |
-          rustup toolchain install stable --profile minimal
-          rustup default stable
-          rustup target add wasm32-unknown-unknown
+          rustup toolchain install "$RUST_TOOLCHAIN" --profile minimal
+          rustup default "$RUST_TOOLCHAIN"
+          rustup target add wasm32-unknown-unknown --toolchain "$RUST_TOOLCHAIN"
 
       - name: Install WebAssembly linker
         run: |
           sudo apt-get update
-          sudo apt-get install --yes lld
+          sudo apt-get install --no-install-recommends --yes lld
 
       - name: Build playground
         env:
           PAGES_BASE_PATH: /${{ github.event.repository.name }}/
         run: vp run playground:build
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: ./playground/dist
 
   deploy:
+    name: Deploy
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    permissions:
+      id-token: write
+      pages: write
 
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4