Automated dependency updates cover both application dependencies and CI dependencies
Pinning actions to SHAs (R-SEC-01) freezes them until something unfreezes them. Without an updater, pinned means unpatched.
Observable check
the repository contains .github/dependabot.yml or a Renovate configuration, and its ecosystem list covers both the package manager the project uses and the CI action or container images it runs.