Hugh Hackman
c8af99da7c
Pin GitHub Actions references to full commit SHAs via Renovate. This ensures supply-chain security by preventing floating tags from silently pointing at different commits. Mirrors the change being made in the org-level renovate-config.json (.github PR #63). Applying it directly here ensures new plugins created from this template have SHA pinning from day one. Related: PRI-731 Co-Authored-By: Paperclip <noreply@paperclip.ing>
21 lines
530 B
JSON
21 lines
530 B
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended"],
|
|
"baseBranches": ["main"],
|
|
"schedule": ["every weekend"],
|
|
"prConcurrentLimit": 10,
|
|
"packageRules": [
|
|
{
|
|
"matchManagers": ["npm"],
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"groupName": "npm minor and patch"
|
|
},
|
|
{
|
|
"matchManagers": ["github-actions"],
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"groupName": "github-actions minor and patch",
|
|
"pinDigests": true
|
|
}
|
|
]
|
|
}
|