diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 121305821..8c0658076 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -38,6 +38,10 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
     - name: Git checkout
+      # Pin actions their full commit hashes to prevent supply-chain attacks.
+      # To update, find the latest tag on the releases page,
+      # then copy the full SHA and paste it back here (and update the comment).
+      # Alternatively, setup Dependabot for the `github-actions` ecosystem.
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         submodules: recursive
diff --git a/new-package/github/workflows/test.yml b/new-package/github/workflows/test.yml
index 494515767..04702ca57 100644
--- a/new-package/github/workflows/test.yml
+++ b/new-package/github/workflows/test.yml
@@ -1,8 +1,28 @@
 name: CI
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the main branch
-on: [push, pull_request]
+# Controls when the action will run.
+on:
+  # Run on pushes to the default branch.
+  push:
+    branches:
+      - main
+
+  # Run on all PRs.
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+  # Support merge queues.
+  merge_group:
+
+  # Allow running this workflow manually from the Actions tab.
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
 
 permissions:
   contents: read
@@ -16,29 +36,44 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Git checkout
+        # Pin actions their full commit hashes to prevent supply-chain attacks.
+        # To update, find the latest tag on the releases page,
+        # then copy the full SHA and paste it back here (and update the comment).
+        # Alternatively, setup Dependabot for the `github-actions` ecosystem.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: recursive
+          clean: true
+          persist-credentials: false
+          set-safe-directory: true
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: lts/*
+          cache: 'npm'
 
       # Re-use node_modules between runs until package-lock.json changes.
       - name: Cache node_modules
-        id: internal-cache-node_modules
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: cache-node_modules
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: node_modules
-          key: internal-node_modules-ubuntu-latest.x-${{ hashFiles('package-lock.json') }}
+          key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            node_modules-${{ runner.os }}-
 
       # Re-use ~/.elm between runs until elm.json, elm-tooling.json or
       # review/elm.json changes. The Elm compiler saves downloaded Elm packages
       # to ~/.elm, and elm-tooling saves downloaded tool executables there.
       - name: Cache ~/.elm
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.elm
-          key: elm-${{ hashFiles('elm.json', 'elm-tooling.json', 'review/elm.json') }}
+          key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
+          restore-keys: |
+            elm-${{ runner.os }}-
 
       - name: Install npm dependencies
         if: steps.cache-node_modules.outputs.cache-hit != 'true'
@@ -76,29 +111,44 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Git checkout
+        # Pin actions their full commit hashes to prevent supply-chain attacks.
+        # To update, find the latest tag on the releases page,
+        # then copy the full SHA and paste it back here (and update the comment).
+        # Alternatively, setup Dependabot for the `github-actions` ecosystem.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: recursive
+          clean: true
+          persist-credentials: false
+          set-safe-directory: true
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: lts/*
+          cache: 'npm'
 
       # Re-use node_modules between runs until package-lock.json changes.
       - name: Cache node_modules
-        id: internal-cache-node_modules
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: cache-node_modules
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: node_modules
-          key: internal-node_modules-ubuntu-latest.x-${{ hashFiles('package-lock.json') }}
+          key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            node_modules-${{ runner.os }}-
 
       # Re-use ~/.elm between runs until elm.json, elm-tooling.json or
       # review/elm.json changes. The Elm compiler saves downloaded Elm packages
       # to ~/.elm, and elm-tooling saves downloaded tool executables there.
       - name: Cache ~/.elm
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.elm
-          key: elm-${{ hashFiles('elm.json', 'elm-tooling.json', 'review/elm.json') }}
+          key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
+          restore-keys: |
+            elm-${{ runner.os }}-
 
       - name: Install npm dependencies
         if: steps.cache-node_modules.outputs.cache-hit != 'true'
diff --git a/test/run-snapshots/elm-review-something-for-new-rule/.github/workflows/test.yml b/test/run-snapshots/elm-review-something-for-new-rule/.github/workflows/test.yml
index 494515767..04702ca57 100644
--- a/test/run-snapshots/elm-review-something-for-new-rule/.github/workflows/test.yml
+++ b/test/run-snapshots/elm-review-something-for-new-rule/.github/workflows/test.yml
@@ -1,8 +1,28 @@
 name: CI
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the main branch
-on: [push, pull_request]
+# Controls when the action will run.
+on:
+  # Run on pushes to the default branch.
+  push:
+    branches:
+      - main
+
+  # Run on all PRs.
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+  # Support merge queues.
+  merge_group:
+
+  # Allow running this workflow manually from the Actions tab.
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
 
 permissions:
   contents: read
@@ -16,29 +36,44 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Git checkout
+        # Pin actions their full commit hashes to prevent supply-chain attacks.
+        # To update, find the latest tag on the releases page,
+        # then copy the full SHA and paste it back here (and update the comment).
+        # Alternatively, setup Dependabot for the `github-actions` ecosystem.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: recursive
+          clean: true
+          persist-credentials: false
+          set-safe-directory: true
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: lts/*
+          cache: 'npm'
 
       # Re-use node_modules between runs until package-lock.json changes.
       - name: Cache node_modules
-        id: internal-cache-node_modules
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: cache-node_modules
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: node_modules
-          key: internal-node_modules-ubuntu-latest.x-${{ hashFiles('package-lock.json') }}
+          key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            node_modules-${{ runner.os }}-
 
       # Re-use ~/.elm between runs until elm.json, elm-tooling.json or
       # review/elm.json changes. The Elm compiler saves downloaded Elm packages
       # to ~/.elm, and elm-tooling saves downloaded tool executables there.
       - name: Cache ~/.elm
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.elm
-          key: elm-${{ hashFiles('elm.json', 'elm-tooling.json', 'review/elm.json') }}
+          key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
+          restore-keys: |
+            elm-${{ runner.os }}-
 
       - name: Install npm dependencies
         if: steps.cache-node_modules.outputs.cache-hit != 'true'
@@ -76,29 +111,44 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Git checkout
+        # Pin actions their full commit hashes to prevent supply-chain attacks.
+        # To update, find the latest tag on the releases page,
+        # then copy the full SHA and paste it back here (and update the comment).
+        # Alternatively, setup Dependabot for the `github-actions` ecosystem.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: recursive
+          clean: true
+          persist-credentials: false
+          set-safe-directory: true
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: lts/*
+          cache: 'npm'
 
       # Re-use node_modules between runs until package-lock.json changes.
       - name: Cache node_modules
-        id: internal-cache-node_modules
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: cache-node_modules
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: node_modules
-          key: internal-node_modules-ubuntu-latest.x-${{ hashFiles('package-lock.json') }}
+          key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            node_modules-${{ runner.os }}-
 
       # Re-use ~/.elm between runs until elm.json, elm-tooling.json or
       # review/elm.json changes. The Elm compiler saves downloaded Elm packages
       # to ~/.elm, and elm-tooling saves downloaded tool executables there.
       - name: Cache ~/.elm
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.elm
-          key: elm-${{ hashFiles('elm.json', 'elm-tooling.json', 'review/elm.json') }}
+          key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
+          restore-keys: |
+            elm-${{ runner.os }}-
 
       - name: Install npm dependencies
         if: steps.cache-node_modules.outputs.cache-hit != 'true'
diff --git a/test/run-snapshots/elm-review-something/.github/workflows/test.yml b/test/run-snapshots/elm-review-something/.github/workflows/test.yml
index 494515767..04702ca57 100644
--- a/test/run-snapshots/elm-review-something/.github/workflows/test.yml
+++ b/test/run-snapshots/elm-review-something/.github/workflows/test.yml
@@ -1,8 +1,28 @@
 name: CI
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the main branch
-on: [push, pull_request]
+# Controls when the action will run.
+on:
+  # Run on pushes to the default branch.
+  push:
+    branches:
+      - main
+
+  # Run on all PRs.
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+  # Support merge queues.
+  merge_group:
+
+  # Allow running this workflow manually from the Actions tab.
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
 
 permissions:
   contents: read
@@ -16,29 +36,44 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Git checkout
+        # Pin actions their full commit hashes to prevent supply-chain attacks.
+        # To update, find the latest tag on the releases page,
+        # then copy the full SHA and paste it back here (and update the comment).
+        # Alternatively, setup Dependabot for the `github-actions` ecosystem.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: recursive
+          clean: true
+          persist-credentials: false
+          set-safe-directory: true
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: lts/*
+          cache: 'npm'
 
       # Re-use node_modules between runs until package-lock.json changes.
       - name: Cache node_modules
-        id: internal-cache-node_modules
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: cache-node_modules
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: node_modules
-          key: internal-node_modules-ubuntu-latest.x-${{ hashFiles('package-lock.json') }}
+          key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            node_modules-${{ runner.os }}-
 
       # Re-use ~/.elm between runs until elm.json, elm-tooling.json or
       # review/elm.json changes. The Elm compiler saves downloaded Elm packages
       # to ~/.elm, and elm-tooling saves downloaded tool executables there.
       - name: Cache ~/.elm
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.elm
-          key: elm-${{ hashFiles('elm.json', 'elm-tooling.json', 'review/elm.json') }}
+          key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
+          restore-keys: |
+            elm-${{ runner.os }}-
 
       - name: Install npm dependencies
         if: steps.cache-node_modules.outputs.cache-hit != 'true'
@@ -76,29 +111,44 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Git checkout
+        # Pin actions their full commit hashes to prevent supply-chain attacks.
+        # To update, find the latest tag on the releases page,
+        # then copy the full SHA and paste it back here (and update the comment).
+        # Alternatively, setup Dependabot for the `github-actions` ecosystem.
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: recursive
+          clean: true
+          persist-credentials: false
+          set-safe-directory: true
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: lts/*
+          cache: 'npm'
 
       # Re-use node_modules between runs until package-lock.json changes.
       - name: Cache node_modules
-        id: internal-cache-node_modules
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        id: cache-node_modules
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: node_modules
-          key: internal-node_modules-ubuntu-latest.x-${{ hashFiles('package-lock.json') }}
+          key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            node_modules-${{ runner.os }}-
 
       # Re-use ~/.elm between runs until elm.json, elm-tooling.json or
       # review/elm.json changes. The Elm compiler saves downloaded Elm packages
       # to ~/.elm, and elm-tooling saves downloaded tool executables there.
       - name: Cache ~/.elm
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.elm
-          key: elm-${{ hashFiles('elm.json', 'elm-tooling.json', 'review/elm.json') }}
+          key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
+          restore-keys: |
+            elm-${{ runner.os }}-
 
       - name: Install npm dependencies
         if: steps.cache-node_modules.outputs.cache-hit != 'true'