GitHub actions improvements

.github/dependabot.yaml

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: Copyright 2024 spdx contributors
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10

.github/workflows/test_context.py

@@ -1,6 +1,5 @@
-# SPDX-FileCopyrightText: 2023 spdx contributors
-#
 # SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: Copyright 2023 spdx contributors
 
 import sys
 from rdflib import Graph

.github/workflows/validate-pr.yml

@@ -1,3 +1,6 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: Copyright 2024 The SPDX Contributors
+
 name: validate PR
 
 on:
@@ -8,14 +11,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
             python-version: "3.12"
       - name: get spec-parser
         run: |
-          git clone --depth=1 --single-branch --branch=main https://github.com/spdx/spec-parser/ /tmp/spec-parser
-          python /tmp/spec-parser/main.py -h
+          git clone --depth=1 --single-branch --branch=main https://github.com/spdx/spec-parser/ ${{ runner.temp }}/spec-parser
+          python ${{ runner.temp }}/spec-parser/main.py -h
       - name: run spec-parser to validate
         run: |
-          python /tmp/spec-parser/main.py -n model
+          python ${{ runner.temp }}/spec-parser/main.py -n model