Hugh Hackman
7d5c6d67d6
Adds `pinDigests: true` to the org-wide Renovate config. Renovate will now automatically pin all GitHub Actions references to full commit SHAs and keep them updated via weekly PRs. This implements the supply-chain hardening goal from PRI-731 without requiring a one-time manual SHA substitution that would quickly become stale. Renovate handles pin creation and ongoing updates, eliminating the toil. The github-actions packageRule is preserved — Renovate will still group minor/patch action tag updates, and each group PR will include the corresponding SHA pins. Co-Authored-By: Paperclip <noreply@paperclip.ing>
21 lines
525 B
JSON
21 lines
525 B
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended"],
|
|
"baseBranches": ["main"],
|
|
"schedule": ["every weekend"],
|
|
"prConcurrentLimit": 5,
|
|
"pinDigests": true,
|
|
"packageRules": [
|
|
{
|
|
"matchManagers": ["npm"],
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"groupName": "npm minor and patch"
|
|
},
|
|
{
|
|
"matchManagers": ["github-actions"],
|
|
"matchUpdateTypes": ["minor", "patch"],
|
|
"groupName": "github-actions minor and patch"
|
|
}
|
|
]
|
|
}
|