[core] Pin GitHub Action to digests

[oliviertassinari]

The idea is to follow https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

You can help mitigate this risk by following these good practices: Pin actions to a full length commit SHA

It uses: https://docs.renovatebot.com/modules/manager/github-actions/. If it works well, we need to apply it to all the other repositories.

[mui-bot]

	Messages
📖	Netlify deploy preview: https://deploy-preview-34855--material-ui.netlify.app/

No bundle size changes

Generated by 🚫 dangerJS against deb5ddc

[michaldudak]

Does it work with GitHub Actions? The docs for pinDigests mention Docker images only.
The doc you linked offers an alternative config setting:

{
  "extends": ["helpers:pinGitHubActionDigests"]
}

[oliviertassinari]

Does it work with GitHub Actions? The docs for pinDigests mention Docker images only.

@michaldudak The support for GitHub Actions was added in renovatebot/renovate#10835.

The doc you linked offers an alternative config setting:

These two are equivalent. I went with the lower level primitives.

[oliviertassinari]

renovatebot/renovate#18578 got merged, so we are likely good. We will see how this goes in the next Renovate PR update cycle.

Edit: it does work, proof: #34929.