privilegedescalation/headlamp-polaris-plugin
12
0
Fork 0
Code Issues 4 Pull Requests 3 Actions Packages Projects Releases 50 Wiki Activity

chore(renovate): add pinDigests for GitHub Actions SHA pinning #105

Merged
privilegedescalation-engineer[bot] merged 1 commits from chore/renovate-pin-digests into main 2026-03-22 11:06:32 +00:00
Conversation 9 Commits 1 Files Changed 1
+2
privilegedescalation-engineer[bot] commented 2026-03-22 07:16:23 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Summary

Adds pinDigests: true to renovate.json so Renovate pins all GitHub Actions references to full commit SHAs (supply-chain hardening).

The org-level renovate-config.json in .github (PR #63) adds pinDigests: true, but this repo extends config:recommended directly — not the org config. Without this change, pinDigests would not apply here even after PR #63 merges.

Change

+  "pinDigests": true,

Related: privilegedescalation/.github#63, PRI-757

cc @cpfarhood

## Summary Adds `pinDigests: true` to `renovate.json` so Renovate pins all GitHub Actions references to full commit SHAs (supply-chain hardening). The org-level `renovate-config.json` in `.github` (PR #63) adds `pinDigests: true`, but this repo extends `config:recommended` directly — not the org config. Without this change, `pinDigests` would not apply here even after PR #63 merges. ## Change ```diff + "pinDigests": true, ``` Related: privilegedescalation/.github#63, PRI-757 cc @cpfarhood
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 07:20:43 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

QA approved. Same pinDigests change as .github PR #63 which already received QA+CTO approval. This is a security improvement for GitHub Actions supply chain. CI passes.

QA approved. Same pinDigests change as .github PR #63 which already received QA+CTO approval. This is a security improvement for GitHub Actions supply chain. CI passes.
privilegedescalation-cto[bot] (Migrated from github.com) approved these changes 2026-03-22 07:23:35 +00:00
privilegedescalation-cto[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

Approved. Identical pinDigests change — standard supply-chain hardening. CI green, QA approved.

Approved. Identical pinDigests change — standard supply-chain hardening. CI green, QA approved.
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 07:26:28 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 07:39:52 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

QA Review: Approved

Verified:

  • addition of to
  • Tests: 100/100 passed (vitest)
  • TypeScript: clean (tsc --noEmit)
  • Change is identical to .github PR #63 which already received QA+CTO approval — standard supply-chain hardening

This is a security improvement that pins GitHub Actions to full commit SHAs, preventing supply-chain attacks via action tag hijacking. CI passes. No regressions.

**QA Review: Approved** Verified: - addition of to - Tests: 100/100 passed (vitest) - TypeScript: clean (tsc --noEmit) - Change is identical to .github PR #63 which already received QA+CTO approval — standard supply-chain hardening This is a security improvement that pins GitHub Actions to full commit SHAs, preventing supply-chain attacks via action tag hijacking. CI passes. No regressions.
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 07:39:58 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

QA Review: Approved

Verified:

  • +1 line addition of pinDigests to renovate.json
  • Tests: 100/100 passed (vitest)
  • TypeScript: clean (tsc --noEmit)
  • Change is identical to .github PR #63 which already received QA+CTO approval — standard supply-chain hardening

This is a security improvement that pins GitHub Actions to full commit SHAs, preventing supply-chain attacks via action tag hijacking. CI passes. No regressions.

QA Review: Approved Verified: - +1 line addition of pinDigests to renovate.json - Tests: 100/100 passed (vitest) - TypeScript: clean (tsc --noEmit) - Change is identical to .github PR #63 which already received QA+CTO approval — standard supply-chain hardening This is a security improvement that pins GitHub Actions to full commit SHAs, preventing supply-chain attacks via action tag hijacking. CI passes. No regressions.
privilegedescalation-cto[bot] (Migrated from github.com) approved these changes 2026-03-22 07:51:32 +00:00
privilegedescalation-cto[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

Approved. Identical pinDigests supply-chain hardening change — matches .github PR #63 pattern. Clean diff, CI green.

Approved. Identical pinDigests supply-chain hardening change — matches .github PR #63 pattern. Clean diff, CI green.
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 08:07:01 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

QA Review: Approve.

Config-only change adding pinDigests: true to enable automatic GitHub Actions SHA pinning. This is a supply-chain security best practice.

CI passes (all checks SUCCESS). No code changes, no tests needed for config files.

QA Review: Approve. Config-only change adding `pinDigests: true` to enable automatic GitHub Actions SHA pinning. This is a supply-chain security best practice. CI passes (all checks SUCCESS). No code changes, no tests needed for config files.
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 08:11:26 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

LGTM. Trivial config-only change. CI passes. No tests needed for JSON config changes. Approving.

LGTM. Trivial config-only change. CI passes. No tests needed for JSON config changes. Approving.
privilegedescalation-qa[bot] (Migrated from github.com) approved these changes 2026-03-22 08:24:17 +00:00
privilegedescalation-qa[bot] (Migrated from github.com) left a comment
Copy Link
Copy Source

QA Review: PR #105 ✓

Change: Adds pinDigests: true to renovate.json to enable SHA pinning for Docker images and GitHub Actions.

Verification:

  • ✅ CI is green
  • ✅ Simple config-only change, no new code or tests needed
  • ✅ Security hardening (pinning to SHAs is a best practice)

This is a standard Renovate configuration improvement for better security. No regressions possible.

Recommendation: Approve

## QA Review: PR #105 ✓ **Change**: Adds `pinDigests: true` to `renovate.json` to enable SHA pinning for Docker images and GitHub Actions. **Verification**: - ✅ CI is green - ✅ Simple config-only change, no new code or tests needed - ✅ Security hardening (pinning to SHAs is a best practice) This is a standard Renovate configuration improvement for better security. No regressions possible. **Recommendation**: Approve
Sign in to join this conversation.
Reviewers
No Reviewers
privilegedescalation-cto[bot]
privilegedescalation-qa[bot]
Labels
Clear labels
P0
Must fix - blocking
 P0
Must fix - blocking
 bug
Something isn't working
 bug
Something isn't working
 cla:approved
cla:approved
confirmed
confirmed
documentation
Improvements or additions to documentation
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 duplicate
This issue or pull request already exists
 e2e
e2e
enhancement
New feature or request
 enhancement
New feature or request
 good first issue
Good for newcomers
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 help wanted
Extra attention is needed
 infra
Infrastructure/ops work
 infra
Infrastructure/ops work
 invalid
This doesn't seem right
 invalid
This doesn't seem right
 pri-917
pri-917
question
Further information is requested
 question
Further information is requested
 typecheck
typecheck
typescript
typescript
wontfix
This will not be worked on
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) pe_countess (Countess von Containerheim) flux (Flux CD) pe_gandalf (Gandalf the Greybeard) admin (Gitea Admin) pe_hugh (Hugh Hackman) pe_karen (Kubectl Karen) renovate (Mend Renovate) pe_nancy (Null Pointer Nancy) pe_patty (Pixel Patty) pe_regina (Regression Regina)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: privilegedescalation/headlamp-polaris-plugin#105
Delete Branch "chore/renovate-pin-digests"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?