Improve GH Actions and Dependabot

[eloi010]

Note

Low Risk
Changes are limited to CI/configuration and should not affect runtime behavior; main risk is CI failures due to updated action versions or stricter permissions/tool install steps.

Overview
Adds a new .github/dependabot.yml to enable weekly Dependabot updates for GitHub Actions, with grouping/labeling and PR limits.

Hardens CI workflows by defaulting permissions to none and granting job-level minimal access, updates actions/checkout and actions/upload-artifact to @v6, and makes the spec build more reproducible by verifying SHA256 for downloaded font/tectonic artifacts and installing required system packages in a single step.

Updates Makefile buildOnGithub-% to invoke system tectonic (matching the workflow install) instead of a repo-local binary.

^{Written by Cursor Bugbot for commit 0ebab0f. This will update automatically on new commits. Configure here.}

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[Copilot]

Pull request overview

This PR adds Dependabot automation for GitHub Actions updates and hardens GitHub Actions workflows by applying least-privilege permissions and modernizing tooling installation in CI.

Changes:

• Add .github/dependabot.yml to open weekly grouped GitHub Actions update PRs with standardized metadata.
• Apply default permissions: {} to workflows and set job-level permissions explicitly.
• Update workflow steps in compile.yml (checkout/upload-artifact versions, credential persistence, and sha256-verified downloads).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/security-code-scanner.yml	Locks default token permissions down and relies on job-level permissions for the reusable scanner workflow call.
.github/workflows/compile.yml	Adds least-privilege permissions and replaces ad-hoc installs with sha256-verified downloads and consolidated apt installs; updates checkout/upload-artifact actions.
.github/dependabot.yml	Introduces Dependabot configuration for weekly GitHub Actions dependency updates with grouping and PR metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

permissions: {} at the workflow level removes all default GITHUB_TOKEN scopes, but this job later uploads an artifact. actions/upload-artifact typically requires the token to have actions: write; with only contents: read granted here, the upload step may be denied. Consider adding the minimal required actions permission at the job level (or to just the upload step via a separate job if you want to keep tighter scoping).

Suggested change

	contents: read
	contents: read
	actions: write

[OlivierBBB]

@eloi010 is that @copilot comment valid ?

[eloi010]

I think it is not. That said, the original workflow never ran with restricted permissions, so this hasn't been tested empirically for this repo. The workflow dispatch will be the definitive proof. If the upload step fails with a 403, then adding actions: write is the fix, but I don't expect it to.

[Copilot]

@OlivierBBB I've opened a new pull request, #367, to work on those changes. Once the pull request is ready, I'll request review from you.

[OlivierBBB]

LGTM, but I'm not particularly knowledgeable on this stuff