feat: add renovate pinDigests config

.github/renovate.json5

@@ -11,6 +11,12 @@
   },
   "ignoreScripts": false,
   "packageRules": [
+    {
+      "matchDepTypes": [
+        "action"
+      ],
+      "pinDigests": true
+    },
     // ignore all major update
     {
       "matchUpdateTypes": ["lockFileMaintenance", "pin", "digest"],

.github/workflows/check-dependencies.yml

@@ -14,15 +14,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
       - name: Install Pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
       - name: Setup Node.js 22
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 22
           cache: 'pnpm'

.github/workflows/diff.yml

@@ -43,7 +43,7 @@ jobs:
           RSDOCTOR=1 pnpm run build
 
       - name: Report Compressed Size
-        uses: web-infra-dev/rsdoctor-action@main
+        uses: web-infra-dev/rsdoctor-action@8fd3b03827afc9de3acf17810be26bb87b6ca6b5 # main
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           file_path: 'benchmark/bundle-diff/dist/rsdoctor-data.json'

.github/workflows/integration-test-Linux.yml

@@ -23,12 +23,12 @@ jobs:
         run: echo "$RUNNER_CONTEXT"
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
       - name: Install Pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
       - name: Check skip CI
         run: echo "RESULT=$(node ./scripts/skipCI.js)" >> "$GITHUB_OUTPUT"
@@ -38,14 +38,14 @@ jobs:
         run: echo "${{steps.skip-ci.outputs.RESULT}}"
 
       - name: Setup Node.js 22.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 22.x
           cache: 'pnpm'
 
       - name: Nx Cache
         id: nx-cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         with:
           path: .nx/cache
           key: nx-${{ github.ref_name }}-${{ github.sha }}

.github/workflows/integration-test-Windows.yml

@@ -28,7 +28,7 @@ jobs:
           git config --system core.longpaths true
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
@@ -44,14 +44,14 @@ jobs:
         run: echo "${{steps.skip-ci.outputs.RESULT}}"
 
       - name: Setup Node.js 22.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 22.x
           cache: 'pnpm'
 
       - name: Nx Cache
         id: nx-cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         with:
           path: .nx/cache
           key: nx-${{ github.ref_name }}-${{ github.sha }}

.github/workflows/issue-label.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label issues
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           github-token: ${{ secrets.REPO_SCOPED_TOKEN }}
           script: |

.github/workflows/lint-Linux.yml

@@ -24,7 +24,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           # This makes Actions fetch only one branch to release
             fetch-depth: 1
@@ -33,7 +33,7 @@ jobs:
         run: npm i -g --force corepack && corepack enable
 
       - name: Setup Node.js 22
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: "22"
           cache: 'pnpm'

.github/workflows/test-builder-e2e.yml

@@ -14,13 +14,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
       - name: Nx Cache
         id: nx-cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         with:
           path: .nx/cache
           key: nx-${{ github.ref_name }}-${{ github.sha }}
@@ -32,7 +32,7 @@ jobs:
         run: npm i -g --force corepack && corepack enable
 
       - name: Setup Node.js 22
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: '22'
           cache: 'pnpm'

.github/workflows/type-check.yml

@@ -19,15 +19,15 @@ jobs:
         run: echo "$RUNNER_CONTEXT"
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
       - name: Install Pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
       - name: Setup Node.js 22
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 22
           cache: 'pnpm'
@@ -42,7 +42,7 @@ jobs:
       - name: Nx Cache
         id: nx-cache
         if: ${{steps.skip-ci.outputs.RESULT != 'true'}}
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         with:
           path: .nx/cache
           key: nx-${{ github.base_ref }}-${{ github.ref_name }}-${{ github.sha }}

.github/workflows/ut-Windows.yml

@@ -24,7 +24,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
@@ -40,7 +40,7 @@ jobs:
         run: echo "${{steps.skip-ci.outputs.RESULT}}"
 
       - name: Setup Node.js 22
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: "22"
           cache: 'pnpm'

.github/workflows/ut-macOS.yml

@@ -24,7 +24,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
@@ -39,7 +39,7 @@ jobs:
         run: echo "${{steps.skip-ci.outputs.RESULT}}"
 
       - name: Setup Node.js 22
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: "22"
           cache: 'pnpm'