ci: pin GitHub Actions by SHA digest via Renovate (#853)

chrisburr · web-flow · commit 3fd90527659a · 2026-03-25T08:03:36.000+01:00
Add the helpers:pinGitHubActionDigests preset to protect against
tag-replacement supply-chain attacks on GitHub Actions.
diff --git a/renovate.json b/renovate.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
   "minimumReleaseAge": "7 days",
   "packageRules": [
     {

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"$schema": "https://docs.renovatebot.com/renovate-schema.json",`
`3`		`- "extends": ["config:recommended"],`
	`3`	`+ "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],`
`4`	`4`	`"minimumReleaseAge": "7 days",`
`5`	`5`	`"packageRules": [`
`6`	`6`	`{`