Pin GitHub Actions to full-length commit SHAs and add Dependabot cooldown

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/cmind-lint.yml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@v19
+        uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19.1.0
         with:
           globs: |
             CoderMind/**/*.md

.github/workflows/cmind-pre-release.yml

@@ -26,7 +26,7 @@ jobs:
       PROJECT_DIR: CoderMind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
           SCRIPTS: "sh ps"
         run: .github/workflows/scripts/cmind/create-release-packages.sh "${{ steps.get_tag.outputs.new_version }}"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         if: steps.check_release.outputs.exists == 'false'
         with:
           python-version: "3.12"

.github/workflows/cmind-release.yml

@@ -25,7 +25,7 @@ jobs:
       PROJECT_DIR: CoderMind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -53,7 +53,7 @@ jobs:
           SCRIPTS: "sh ps"
         run: .github/workflows/scripts/cmind/create-release-packages.sh "${{ steps.get_tag.outputs.new_version }}"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         if: steps.check_release.outputs.exists == 'false'
         with:
           python-version: "3.12"

.github/workflows/cmind-security-tests.yml

@@ -24,10 +24,10 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Build and install wheel on disposable CI runner

CoderMind/docs/project-structure.md

@@ -178,3 +178,9 @@ Runtime logs are written under `~/.cmind/workspaces/<workspace-id>/logs/`, for e
 Execution traces are written under `~/.cmind/workspaces/<workspace-id>/data/trajectory/`. Review or diagnostic artifacts may be written under `<workspace>/.cmind/reports/` when a command generates them.
 
 To discover the home-side paths (data / logs / inner-git) for the current workspace, run `cmind version` from anywhere inside it—the relevant lines are labelled **Workspace**, **Data**, **Logs**, and **Inner git**.
+
+## Repository CI Configuration
+
+In the CoderMind source repository, remote actions in [GitHub workflows](../../.github/workflows/) are pinned to full-length commit SHAs with version comments, rather than mutable tags. When updating an action manually, verify the upstream release commit and update both the SHA and its version comment. Local reusable workflow references stay relative to the repository.
+
+[Dependabot](../../.github/dependabot.yml) checks GitHub Actions weekly, groups their updates, and applies a seven-day cooldown before proposing newly released versions. The pins and cooldown reduce supply-chain risk; they do not replace reviewing action updates.