add dependabot updates and linkcheck

.github/workflows/check_sphinx_build.yml

@@ -1,38 +1,41 @@
 name: Check Sphinx Build
+
 on:
   pull_request:
     branches: [master, source]
 
 jobs:
-  jekyll_build:
-    name: Jekyll build of web pages
+  build-docs:
+    name: Sphinx  build of web pages
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-      # https://github.com/actions/checkout
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           submodules: true
 
       - name: Install Conda environment from environment.yml
-        uses: mamba-org/setup-micromamba@v2.0.0
+        uses: mamba-org/setup-micromamba@0dea6379afdaffa5d528b3d1dabc45da37f443fc  # v2.0.4
         with:
           environment-file: environment.yml
           cache-environment: true
 
       - name: Build documentation
         shell: bash -l {0}
         run: |
-          make html
+          make html linkcheck
 
       # workaround https://github.com/actions/upload-artifact/issues/38
       - name: tarball
         run: tar czf site.tar.gz ./_build/html/
 
       # https://github.com/actions/upload-artifact
       - name: Upload Website artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # 4.6.2
         with:
           name: Website
           path: site.tar.gz

.github/workflows/dependabot.yml

@@ -0,0 +1,15 @@
+# See https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot
+
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    groups:
+      github-actions:
+        patterns:
+          - '*'