From 1bf4b7ce380749785274f5154d9b46b22fa0ce74 Mon Sep 17 00:00:00 2001
From: chaokunyang <shawn.ck.yang@gmail.com>
Date: Sun, 27 Sep 2026 16:45:13 +0800
Subject: [PATCH] ci: update GraalVM action and enable Dependabot

---
 .github/dependabot.yml   | 36 ++++++++++++++++++++++++++++++++++++
 .github/workflows/ci.yml |  6 +++---
 2 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..27079d1673
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    # Give ASF Infrastructure time to approve new action releases first.
+    cooldown:
+      default-days: 4
+    commit-message:
+      prefix: ci
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+      github-actions-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6e7c2139ae..05739d1623 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -660,7 +660,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v5
-      - uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # 1.5.6
+      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -687,7 +687,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v5
-      - uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # 1.5.6
+      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -711,7 +711,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # 1.5.6
+      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
         with:
           java-version: "25"
           distribution: "graalvm"