Merge pull request #606 from smartlyio/renovate-patch

[VLCN-3590] Renovate now pins everything but Smartly's actions

Author: sla686

renovate.json

@@ -59,6 +59,12 @@
       "matchDepTypes": ["devDependencies"],
       "matchUpdateTypes": ["major"],
       "labels": ["patch", "renovate-deps"]
+    },
+    {
+      "description": "Pin third-party GitHub Actions to digest SHAs only; Smartly-owned actions stay tag-based (after catch-all pin rules so pinDigests is not overridden)",
+      "matchManagers": ["github-actions"],
+      "matchPackageNames": ["/^smartlyio\\//"],
+      "pinDigests": false
     }
   ],
   "github-actions": {