CI/AUTO: SHA Pinning and Dependabot

.github/dependabot_template.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+      exclude:
+      - pcdshub/pcds-ci-helpers/*

.github/workflows/standard.yml

@@ -9,24 +9,24 @@
 
 jobs:
   standard:
-    uses: pcdshub/pcds-ci-helpers/.github/workflows/python-standard.yml@master
+    uses: pcdshub/pcds-ci-helpers/.github/workflows/python-standard.yml@2e7e5ec8fb8afca5fa0cdb60b82b0f1b99cd2647
     secrets: inherit
     with:
       # The workflow needs to know the package name.  This can be determined
       # automatically if the repository name is the same as the import name.
       package-name: "hutch_python"
       # Extras that will be installed for both conda/pip:
       testing-extras: ""
       # Extras to be installed only for conda-based testing:
       conda-testing-extras: ""
       # Extras to be installed only for pip-based testing:
       # Set numpy<2 for now, remove when xraylib updates
       pip-testing-extras: ""
       # System packages to be installed only for conda-based testing:
       conda-system-packages: ""
       # System packages to be installed only for pip-based testing:
       pip-system-packages: "libkrb5-dev"
       # System packages to be installed only for documentation:
       docs-system-packages: "pandoc"
       # Set if using setuptools-scm for the conda-build workflow
       use-setuptools-scm: true