Gandalf the Greybeard
ee3cdc63f1
Adds pinDigests: true so Renovate pins all GitHub Actions references to full commit SHAs for supply-chain hardening. This repo extends config:recommended directly, so pinDigests must be set here explicitly — the org-level config alone is not sufficient. Recreated from main after closing stale PR #23 (branch was created before the dual-approval PR #22 landed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
21 lines
526 B
JSON
21 lines
526 B
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended"],
|
|
"pinDigests": true,
|
|
"baseBranches": ["main"],
|
|
"schedule": ["every weekend"],
|
|
"prConcurrentLimit": 10,
|
|
"packageRules": [
|
|
{
|
|
"matchManagers": ["npm"],
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"groupName": "npm minor and patch"
|
|
},
|
|
{
|
|
"matchManagers": ["github-actions"],
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"groupName": "github-actions minor and patch"
|
|
}
|
|
]
|
|
}
|