Myasnikov Daniil 56108eca83 ci(renovate): pin base images and GitHub Actions to digests ...

Enable Renovate's dockerfile and github-actions managers with
pinDigests so OpenSSF Scorecard Pinned-Dependencies (currently 1/10)
can pass and supply-chain refs stay reproducible.

PR #2849 SHA-pinned actions in 13 workflows, but the check also scores
container base images -- 58 unpinned FROM lines across 27 distinct
images -- and left build-main.yaml / release-e2e.yaml unpinned.
Nothing kept the new action SHAs updated either, so they would
silently stop receiving security patches.

Enabling the managers lets Renovate open the initial pin PR (and pin
the two missed workflows) and keep digests fresh thereafter.
Digest-only refreshes and the initial pin are batched into a single
weekly PR to avoid a trickle of rebuild-triggering PRs on the shared
CI runner; real tag bumps stay individual for review.

Also pin s3manager's floating tags (golang:1, alpine:latest) to
concrete versions first, otherwise digest tracking churns endlessly.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

2026-06-24 12:07:49 +05:00

..

apps

feat(harbor): bump chart to 1.19.1 (Harbor 2.15.1) (#2966)

2026-06-23 14:32:43 +03:00

core

chore(testing): refresh e2e-sandbox tools and base to current upstream (#3010)

2026-06-23 13:14:20 +03:00

extra

feat(ingress): issue shared DNS-01 wildcard on the publishing controller

2026-06-22 20:01:40 +03:00

library

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00

system

ci(renovate): pin base images and GitHub Actions to digests

2026-06-24 12:07:49 +05:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00