From 9c8000501dc3d999f8056e7e568641c6905b59a3 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 23 Aug 2026 23:30:42 +0200 Subject: [PATCH] fix(renovate): let Renovate pin references to this repo The pinDigests rule excluded reqstool/*, so consumers' references to this repo were never pinned and stayed on a mutable @main. The exclusion was written when the only first-party references were inside this repo, where $/ makes pinning moot -- but this config is extended by every repo in the org, so it reached much further than intended. With consumers now pinning to the 1.0.0 tag, this rule is what keeps those pins current: Renovate bumps the digest and rewrites the version comment on each new tag here. actions/* and github/* stay excluded, unchanged -- they sit inside the same trust boundary as the runner. Closes #25. Signed-off-by: Jimisola Laursen --- .github/renovate.json5 | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 375ae0f..4aee938 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -271,19 +271,25 @@ automerge: true, }, - // Third-party actions are pinned to a commit digest, first-party ones are - // not. The split is deliberate: a `v4` tag is mutable, so trusting one from - // an account outside this org means trusting whoever can move it — which is - // what CodeQL's actions/unpinned-tag flags. GitHub's own `actions/*` sit - // inside the same trust boundary as the runner, and pinning them would - // replace the major-tag automerge above with a digest bump per action per - // week for no change in exposure. + // Everything but GitHub's own actions is pinned to a commit digest. A `v4` + // tag is mutable, so trusting one means trusting whoever can move it — + // which is what CodeQL's actions/unpinned-tag flags. GitHub's own + // `actions/*` sit inside the same trust boundary as the runner, and pinning + // them would replace the major-tag automerge above with a digest bump per + // action per week for no change in exposure. // - // Renovate keeps the digests current and rewrites the `# vX.Y.Z` comment + // `reqstool/*` was excluded until 2026-08-23. That was written when the + // only first-party references were inside this repo, where `$/` makes + // pinning moot — but this config is extended by every repo in the org, so + // it also stopped their references to *this* repo being pinned, leaving + // them on a mutable `@main`. See reqstool/.github#25; consumers now pin to + // a tag, and this rule is what keeps those pins current. + // + // Renovate keeps the digests current and rewrites the `# X.Y.Z` comment // alongside them, so the pins do not silently rot. { matchManagers: ["github-actions"], - matchPackageNames: ["!/^(actions|github)\\//", "!/^reqstool\\//"], + matchPackageNames: ["!/^(actions|github)\\//"], pinDigests: true, addLabels: ["renovate-type-cicd"], },