The renovate.json configuration uses the config:base preset but does not enable helpers:pinGitHubActionDigests or github-actions manager pinning. Renovate will propose tag-based updates (e.g. v5 to v6) rather than SHA-based pins. This means even if someone fixes the unpinned actions today, Renovate will revert them to tag-based references on the next update PR.
REPRODUCTION: Check Renovate's update PRs — they update tags, not SHAs.
IMPACT: Unpinned actions will stay unpinned or be re-unpinned after updates, perpetuating the supply chain risk.
The renovate.json configuration uses the config:base preset but does not enable helpers:pinGitHubActionDigests or github-actions manager pinning. Renovate will propose tag-based updates (e.g. v5 to v6) rather than SHA-based pins. This means even if someone fixes the unpinned actions today, Renovate will revert them to tag-based references on the next update PR.
REPRODUCTION: Check Renovate's update PRs — they update tags, not SHAs.
IMPACT: Unpinned actions will stay unpinned or be re-unpinned after updates, perpetuating the supply chain risk.