Update GitHub Actions to use specific version digests and add Renovate configuration

.github/workflows/end-to-end.yml

@@ -12,7 +12,7 @@ jobs:
       # contents:write is required to upload to the release assets
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           fetch-tags: 'true'
           ref: ${{ github.ref }}
@@ -53,10 +53,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           repository: asgrim/example-pie-extension
           path: ext
@@ -69,15 +69,15 @@ jobs:
           mv ext/zend_example_pie_extension.c .
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php-versions }}
         env:
           # debug: ${{ matrix.zend-debug }} @todo may not be able to use https://github.com/shivammathur/setup-php/issues/816
           phpts: ${{ matrix.zts-mode }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -122,10 +122,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Checkout test extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           repository: asgrim/example-pie-extension
           path: ext
@@ -138,7 +138,7 @@ jobs:
           mv ext/zend_example_pie_extension.c .
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -171,7 +171,7 @@ jobs:
     needs: [test-action, test-action-alpine]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Delete test release
         run: |

.github/workflows/release.yml

@@ -12,15 +12,15 @@ jobs:
     name: Build dist and update tags
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           ref: ${{ github.event.release.tag_name }}
-      - uses: actions/setup-node@v4
+      - name: Build dist
+        uses: miguelcolmenares/npm-auto-build@8c22581033b30b631ff66f6c1b72fa3bdc2ea312 # v2.1.2
         with:
-          node-version: '20'
-          cache: 'npm'
-      - run: npm ci
-      - run: npm run build
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          node-version: '24'
+          build-only: 'true'
       - name: Commit dist to release tag
         run: |
           git config user.name "github-actions[bot]"

.github/workflows/test.yml

@@ -8,12 +8,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
-          node-version: 20
+          node-version: '24'
           cache: 'npm'
 
       - name: Install Dependencies

renovate.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests",
+    ":automergePatch",
+    ":automergeMinor",
+    ":automergeBranch"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": ["github-actions"],
+      "pinDigests": true
+    }
+  ]
+}