Use pinact for actions updates in template

.github/workflows/gha-update.yml

@@ -1,19 +1,18 @@
-name: Update GitHub Actions versions in template
+name: Update GitHub Actions versions
 permissions:
     contents: write
     pull-requests: write
 
 on:
   # Allow manual runs through the web UI
   workflow_dispatch:
-  # This is currently disabled because it would cause all updates to fail
-  #schedule:
-  #  #        ┌───────── minute (0 - 59)
-  #  #        │ ┌───────── hour (0 - 23)
-  #  #        │ │ ┌───────── day of the month (1 - 31)
-  #  #        │ │ │ ┌───────── month (1 - 12 or JAN-DEC)
-  #  #        │ │ │ │ ┌───────── day of the week (0 - 6 or SUN-SAT)
-  #  - cron: '0 7 * * 1'  # Every Monday at 7am UTC
+  schedule:
+    #        ┌───────── minute (0 - 59)
+    #        │ ┌───────── hour (0 - 23)
+    #        │ │ ┌───────── day of the month (1 - 31)
+    #        │ │ │ ┌───────── month (1 - 12 or JAN-DEC)
+    #        │ │ │ │ ┌───────── day of the week (0 - 6 or SUN-SAT)
+    - cron: '0 7 * * 1-5'  # Every day at 7am UTC
 
 jobs:
   update:
@@ -27,25 +26,18 @@ jobs:
       - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
         with:
           skip_push: "true"
-          update: "true"
-          verify: "true"
-          verify_min_age: "true" # pinact run --verify-min-age
-          min_age: "7"
-          includes: |
-            {{ cookiecutter.package_name }}/.github/workflows/.*
-          branch_to_tags: |
-            ^main$
-          separator: "  # "
+          config: .pinact.yaml
 
       - name: Create pull request
+        if: '!cancelled()'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: .
           delete-branch: true
-          branch-suffix: timestamp
+          branch: create-pull-request/pinact-actions-update
           title: "Update GitHub Actions versions"
           body: |
             This is an autogenerated PR which updates GitHub Actions version pins.
 
-            Generated by [gha-update](https://github.com/davidism/gha-update).
+            Generated by [pinact](https://github.com/suzuki-shunsuke/pinact).

.pinact.yaml

@@ -0,0 +1,22 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/refs/heads/main/json-schema/pinact.json
+# pinact - https://github.com/suzuki-shunsuke/pinact
+version: 3
+min_age:
+  value: 7      # threshold in days
+  always: false # allow early updates
+separator: "  # "
+files:
+  - pattern: .github/workflows/*.yml
+  - pattern: "{{ cookiecutter.package_name }}/.github/workflows/*.yml"
+
+# rules:
+#   - ignore: true
+#     conditions:
+#       - expr: |
+#           ActionName == "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml" && ActionVersion matches "v\\d+\\.\\d+\\.\\d+"
+#       - expr: |
+#           ActionRepoOwner == "suzuki-shunsuke" && ActionVersion == "main"
+#   - min_age: 0
+#     conditions:
+#       - expr: |
+#           ActionName matches "actions/.*"