From cd55d1bbbaaff548bf69ba7bc01fc799d15cb092 Mon Sep 17 00:00:00 2001
From: "privilegedescalation-engineer[bot]"
 <269729446+privilegedescalation-engineer[bot]@users.noreply.github.com>
Date: Sun, 22 Mar 2026 07:16:12 +0000
Subject: [PATCH] chore(renovate): add pinDigests to ensure SHA pinning for
 GitHub Actions

The org renovate-config.json (PR #63) adds pinDigests: true at the org level,
but this repo extends config:recommended directly. Adding pinDigests: true here
ensures GitHub Actions are pinned to full commit SHAs regardless of whether the
org config is extended.

Related: privilegedescalation/.github#63, PRI-757
---
 renovate.json | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/renovate.json b/renovate.json
index 9ca1ba1..d9ce489 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,6 +4,7 @@
   "baseBranches": ["main"],
   "schedule": ["every weekend"],
   "prConcurrentLimit": 10,
+  "pinDigests": true,
   "packageRules": [
     {
       "matchManagers": ["npm"],
@@ -17,3 +18,4 @@
     }
   ]
 }
+