Hugh Hackman
7d5c6d67d6
Adds `pinDigests: true` to the org-wide Renovate config. Renovate will now automatically pin all GitHub Actions references to full commit SHAs and keep them updated via weekly PRs. This implements the supply-chain hardening goal from PRI-731 without requiring a one-time manual SHA substitution that would quickly become stale. Renovate handles pin creation and ongoing updates, eliminating the toil. The github-actions packageRule is preserved — Renovate will still group minor/patch action tag updates, and each group PR will include the corresponding SHA pins. Co-Authored-By: Paperclip <noreply@paperclip.ing>