Repository navigation
Conversation
Mutable third-party tags can change the code that CI runs without review. Lock each current ref to its verified upstream commit while keeping internal fixes on their shared rolling tags. Closes DEVOPS-1683
Renovate should create and maintain the pinning changes. Restore the manual workflow edits so this PR only adjusts the existing Renovate policy. Refs DEVOPS-1683
Piotr1215
changed the title
Internal action version changes must stay manual. Digest pinning alone still lets Renovate propose version bumps, so disable updates for loft-sh/** while retaining the digest exemption. Follow the policy in e6a29fe0c03cc247c1b3908ee5d33020d92ae1ef. Refs DEVOPS-1683
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Let Renovate propose and maintain SHA pins for third-party GitHub Actions; internal refs remain manually chosen rolling tags, with
enabled: falseblocking bot version and digest updates and explicitpinDigests: falseretained. This PR changes onlyrenovate.json; existing managers and schedules are preserved.Test plan
Renovate 44.165.2 config validation passed.
Closes DEVOPS-1683