Merge pull request #66 from kaitj/maint/dependencies

Address security alerts

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the default location of `.github/workflows`. 
+    # (You don't need to specify `/.github/workflows` for `directory`. 
+    # You can use `directory: "/"`.)
+    directory: "/"
+    # Run on first of each month
+    schedule:
+      interval: "monthly"
+    # Group to submit a single PR if possible
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/grab_articles.yml

@@ -11,12 +11,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup environment
-        uses: khanlab/actions/.github/actions/[email protected].3
+        uses: khanlab/actions/.github/actions/[email protected].6
         with:
           python-version: "3.10"
 
       - name: Checkout master branch
-        uses: actions/checkout@master
+        uses: actions/checkout@v4
 
       - name: Run notebook
         run: |
@@ -34,7 +34,7 @@ jobs:
 
       # Creates a PR for review if new article(s) found
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v6
         if: steps.article-condition.outputs.hit == 'true'
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -53,8 +53,9 @@ jobs:
           git config --local user.name "github-actions[bot]"
           git commit -m "Update publications spreadsheet" -a
 
+      # Look to replace this with a versioned github-push action
       - name: Push to master
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@v0.8.0
         if: steps.article-condition.outputs.hit != 'true'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}