From eee491f871091e5c593ddccb68c0bb65c66b05ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jadrian=20Sardi=C3=B1as?= <jsardinas@mbta.com>
Date: Tue, 9 Jun 2026 15:30:34 -0400
Subject: [PATCH] Update asdf in CI actions to >=0.16.0.

---
 .github/dependabot.yml       | 4 ++++
 .github/workflows/elixir.yml | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index efed2e32b..0e9a82833 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,10 @@ updates:
   schedule:
     interval: daily
   open-pull-requests-limit: 10
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
 - package-ecosystem: mix
   directory: "/apps/api_accounts"
   schedule:
diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml
index e2f01c4d8..1f414bc41 100644
--- a/.github/workflows/elixir.yml
+++ b/.github/workflows/elixir.yml
@@ -18,15 +18,15 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v3
-      # cache the ASDF directory, using the values from .tool-versions
+      # Cache the ASDF directory, using the values from .tool-versions.
       - name: ASDF cache
         uses: actions/cache@v4
         with:
           path: ~/.asdf
           key: ${{ runner.os }}-asdf-v3-${{ hashFiles('.tool-versions') }}
         id: asdf-cache
-      # only run `asdf install` if we didn't hit the cache
-      - uses: asdf-vm/actions/install@v1
+      # Only run `asdf install` if we didn't hit the cache.
+      - uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47  # a.k.a. @4.0.1
         if: steps.asdf-cache.outputs.cache-hit != 'true'
       - run: |
           mix local.rebar --force