From f21574d38d7c44cc856c22245b84b015c52241e7 Mon Sep 17 00:00:00 2001
From: Steven Borrelli <steve@borrelli.org>
Date: Wed, 29 Jul 2026 19:29:29 +0100
Subject: [PATCH] security: configure Renovate to pin GitHub Actions with SHA
 digests

Configures Renovate to use SHA256 digests when updating GitHub Actions
for improved supply chain security. This ensures that action versions
are pinned to specific commits, preventing potential security issues
from compromised tags or branches.

Benefits:
- Protects against tag/branch hijacking attacks
- Provides immutable references to action versions
- Aligns with security best practices (SLSA, OpenSSF)
- Maintains automatic updates while improving security posture

Signed-off-by: Steven Borrelli <steve@borrelli.org>
---
 renovate.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/renovate.json b/renovate.json
index e66f74b..3155496 100644
--- a/renovate.json
+++ b/renovate.json
@@ -17,6 +17,13 @@
         "example/**"
       ],
       "groupName": "examples"
+    },
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "pinDigests": true,
+      "groupName": "GitHub Actions"
     }
   ]
 }