.forgejo/workflows/renovate.yml

@@ -25,10 +25,10 @@ jobs:
       image: renovate/renovate:39.93.1@sha256:5426f9806430ffa9e5732cf4e93448ffaaf3e5041d0afa1aba7a270afe6b696e
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: "Import Secrets"
         id: "import-secrets"
-        uses: "https://github.com/hashicorp/vault-action@v3"
+        uses: "https://github.com/hashicorp/vault-action@d1720f055e0635fd932a1d2a48f87a666a57906c" # v3
         with:
           url: "https://vault.w9r.dev"
           method: "approle"
@@ -44,7 +44,7 @@ jobs:
             kv/data/ci/renovatebot ciToken | RENOVATE_TOKEN ;
             kv/data/ci/renovatebot githubToken | GITHUB_COM_TOKEN ;
       - name: Load renovate repo cache
-        uses: https://github.com/actions/cache@v4
+        uses: https://github.com/actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: |
             .tmp/cache/renovate/repository
@@ -55,7 +55,7 @@ jobs:
             repo-cache-            
       - name: "Import Commit Signing GPG key"
         id: "import-gpg"
-        uses: "https://github.com/crazy-max/ghaction-import-gpg@v6"
+        uses: "https://github.com/crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5" # v6
         with:
           gpg_private_key: "${{ env.RENOVATE_GPG_PRIVATE_KEY }}"
           passphrase: "${{ env.RENOVATE_GPG_PASSPHRASE }}"
@@ -87,7 +87,7 @@ jobs:
 
       - name: Save renovate repo cache
         if: always() && env.RENOVATE_DRY_RUN != 'full'
-        uses: https://github.com/actions/cache@v4
+        uses: https://github.com/actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: |
             .tmp/cache/renovate/repository