From 325a2577016cea97ab66316e4e65b9987560f13b Mon Sep 17 00:00:00 2001 From: Alan Agius Date: Thu, 30 Jul 2026 14:32:35 +0000 Subject: [PATCH] feat(renovate-presets): pin GitHub Actions to SHA digests and ignore next tag for angular/dev-infra Extend the `helpers:pinGitHubActionDigests` Renovate preset in `default.json5` to automatically pin GitHub Actions to immutable commit SHAs with a trailing version comment (e.g. `@ # ` or `@ # `). Additionally, configure `followTag: null` for `angular/dev-infra` since action references from `angular/dev-infra` do not publish a `next` tag. --- renovate-presets/default.json5 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/renovate-presets/default.json5 b/renovate-presets/default.json5 index 50d9b0e87..de194ea20 100644 --- a/renovate-presets/default.json5 +++ b/renovate-presets/default.json5 @@ -1,6 +1,6 @@ { $schema: 'https://docs.renovatebot.com/renovate-schema.json', - extends: ['mergeConfidence:all-badges', 'group:monorepos'], + extends: ['mergeConfidence:all-badges', 'group:monorepos', 'helpers:pinGitHubActionDigests'], dependencyDashboard: true, rangeStrategy: 'replace', automerge: false, @@ -136,10 +136,10 @@ ], }, - // @angular/benchpress is not released as 'next' + // @angular/benchpress, @angular/dev-infra and angular/dev-infra are not released as 'next' { followTag: null, - matchDepNames: ['@angular/benchpress'], + matchDepNames: ['@angular/benchpress', '@angular/dev-infra', 'angular/dev-infra'], }, // Disable 'next' tag tracking on non-main branches