Microsoft publishes updates to this action using the same scheme
as GitHub, where the v1 tag is updated to the latest release of
the 1.0 series. Therefore, we can manage updates manually.
Use dependabot to manage the dependencies defined in package.json and
GitHub Actions workflows, so that we can proactively update versions.
Outdated versions of third-party dependencies frequently have known
security vulnerabilities with CVEs.
Joe Previte
Jonathan Yu