Pin npm hash

Author: trask

.github/renovate.json5

@@ -198,16 +198,6 @@
         'npx (?<depName>[^@]+)@(?<currentValue>[^\\s]+)',
       ],
     },
-    {
-      customType: 'regex',
-      datasourceTemplate: 'npm',
-      managerFilePatterns: [
-        '.github/workflows/**',
-      ],
-      matchStrings: [
-        'npm install (?<depName>[^@\\s]+)@(?<currentValue>[^\\s]+)',
-      ],
-    },
     {
       customType: 'regex',
       datasourceTemplate: 'java-version',

.github/scripts/package-lock.json

@@ -0,0 +1,9 @@
+{
+  "//": "Dependencies for GitHub Actions workflows that use actions/github-script",
+  "name": "github-scripts",
+  "version": "1.0.0",
+  "private": true,
+  "dependencies": {
+    "yaml": "2.8.0"
+  }
+}

.github/scripts/package.json

@@ -19,8 +19,16 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Install yaml
-        run: npm install [email protected]
+      - name: Setup Node.js
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: .github/scripts/package-lock.json
+
+      - name: Install dependencies
+        working-directory: .github/scripts
+        run: npm ci
 
       - name: Parse component label and assign owners
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0