From fc8117bcd1eb28624cf2b4731b4c51e0ba3f869d Mon Sep 17 00:00:00 2001
From: Cristian Magherusan-Stanciu <cristi.magherusan@gmail.com>
Date: Sat, 17 Oct 2026 19:13:27 +0200
Subject: [PATCH] ci(tooling): pin pre-commit hook repos, YAML-check workflows,
 add Dependabot

From the 2026-07-28 review:

- Pin the three third-party pre-commit hook repos to full commit SHAs,
  with the version as a trailing comment, as the Actions already are.
  A re-pointed tag could otherwise run new code in CI.
- Stop excluding .github/workflows from check-yaml, so a syntax-broken
  workflow fails a check instead of silently not running.
- Lower golangci-lint's gocyclo threshold from 15 to 10 to match the
  standalone gocyclo gates in CI, the Makefile and pre-commit.
- Add Dependabot for github-actions, gomod and the server.json
  validator's npm dependencies, weekly and grouped.

Closes #23

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml  | 26 ++++++++++++++++++++++++++
 .golangci.yml           |  2 +-
 .pre-commit-config.yaml |  8 ++++----
 3 files changed, 31 insertions(+), 5 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a4ece51
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 2
+    groups:
+      github-actions:
+        patterns: ["*"]
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 2
+    groups:
+      gomod:
+        patterns: ["*"]
+  - package-ecosystem: npm
+    directory: /.github/scripts/server-json-validator
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 2
+    groups:
+      npm:
+        patterns: ["*"]
diff --git a/.golangci.yml b/.golangci.yml
index 110ff31..ed78d9d 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -40,7 +40,7 @@ linters:
         hugeParam:
           sizeThreshold: 1024
     gocyclo:
-      min-complexity: 15
+      min-complexity: 10
     gosec:
       excludes:
         - G104
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 02f67e8..70fd1fc 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -30,7 +30,7 @@ repos:
 
   # Terraform formatting
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.105.0
+    rev: d0e12caebb2ab0ee8bf98181c8bfe9702bca103d  # v1.105.0
     hooks:
       - id: terraform_fmt
         name: Terraform format
@@ -43,7 +43,7 @@ repos:
 
   # General file checks
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # v6.0.0
     hooks:
       - id: trailing-whitespace
         name: Trim trailing whitespace
@@ -51,7 +51,7 @@ repos:
         name: Fix end of files
       - id: check-yaml
         name: Check YAML syntax
-        exclude: '^(docker-compose.*\.yml|\.github/workflows/.*|cloudformation/.*|iac/.*/cloudformation/.*)$'
+        exclude: '^(docker-compose.*\.yml|cloudformation/.*|iac/.*/cloudformation/.*)$'
       - id: check-json
         name: Check JSON syntax
       - id: check-added-large-files
@@ -139,7 +139,7 @@ repos:
 
   # Markdown linting
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.47.0
+    rev: 76b3d32d3f4b965e1d6425253c59407420ae2c43  # v0.47.0
     hooks:
       - id: markdownlint
         name: Lint Markdown files