Merge pull request #109 from target/sync-again

Sync again: migrate Renovate config, add GHA version pins and specs

Author: colindean

.github/renovate.json5

@@ -1,10 +1,12 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
   // This inhibits Renovate automerging updates when Dependabot handles that on public GitHub.
-  "packageRules": [
+  packageRules: [
     {
-      "matchPackagePatterns": ["*"],
-      "automerge": false
-    }
-  ]
+      automerge: false,
+      matchPackageNames: [
+        '*',
+      ],
+    },
+  ],
 }

.github/workflows/dependabot-automerge.yaml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs

.github/workflows/make-based-ci.yml

@@ -18,7 +18,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     # This will post a comment on PRs when poetry.lock changes
     - name: Diff poetry.lock
       uses: nborrmann/diff-poetry-lock@c0afd3666864cec339f03ee5c5cf9cb671780c12
@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Set up Homebrew
       id: set-up-homebrew

.github/workflows/pre-commit-updates.yml

@@ -11,15 +11,15 @@ jobs:
   auto-update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
 
-      - uses: browniebroke/[email protected]
+      - uses: browniebroke/pre-commit-autoupdate-action@deb83bfe0036e1116ee4e241d6220274d69b1f9e # v1.0.0
         env:
           SKIP: "Reset Poetry Project Version to 0.0.0"
 
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7
         if: always()
         with:
           token: ${{ secrets.GITHUB_TOKEN }}