chore: improve workflows

.github/dependabot.yml

@@ -10,9 +10,9 @@ updates:
         patterns:
           - "*"  # Group all updates into a single larger pull request.
     schedule:
-      interval: weekly
-      day: sunday
-      time: "11:00" # 11am UTC
+      interval: monthly
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: github-actions
     directory: /
@@ -22,5 +22,5 @@ updates:
           - "*"  # Group all updates into a single larger pull request.
     schedule:
       interval: monthly
-      day: sunday
-      time: "11:00" # 11am UTC
+    cooldown:
+      default-days: 7

.github/workflows/linting.yml

@@ -39,3 +39,15 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           version: ${{ env.GOLANGCI_LINT_VERSION }}
+
+  check-github-action:
+    name: Check GitHub Actions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false
+          annotations: true

.github/workflows/scorecards.yml

@@ -69,6 +69,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.5
+        uses: github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.35.3
         with:
           sarif_file: results.sarif

.github/workflows/test.yml

@@ -22,6 +22,10 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
+      - if: ${{ matrix.os == 'windows-latest' }} # https://github.com/actions/checkout/issues/135
+        run: |
+          git config --global core.eol lf
+          git config --global core.autocrlf input
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -31,9 +35,7 @@ jobs:
 
       - name: Check and get dependencies
         run: |
-          go mod tidy
-          git diff --exit-code go.mod
-          git diff --exit-code go.sum
+          go mod tidy --diff
 
       - name: Test
         run: go test -v -race ./...

zizmor.yml

@@ -1,5 +1,3 @@
 rules:
-  dependabot-cooldown:
-    disable: true
   secrets-outside-env:
     disable: true