set renovate bot to update github actions within workflows (yml files)

[marcoieni]

This is recommended by renovate.
Also, change the used tags of the actions to commit hashes. Look "action pinning" in renovate bot 👍

[Boshen]

Hi, I've enabled "Require actions to be pinned to a full-length commit SHA" in the github actions settings page for my entire org.

I'm keen to migrate this repo over to renovate bot and use "helpers:pinGitHubActionDigests" and what you have already done for release-plz.

https://github.com/release-plz/release-plz/blob/main/.github/renovate.json5

I'm also happy to help you maintain this action if you trust me and give me some maintenance permissions 😁

[Boshen]

Anyway, here's a quick PR: #223

[marcoieni]

unfortunately we can't migrate taiki-e/install-action@v2 to use hash commits easily because that action is updated after we publish the release-plz binary (the delay can be three hours).
See for example https://github.com/taiki-e/install-action/releases/tag/v2.61.4

And I want to release the action right after I release the binary.

That said I'm fine finding another way to install release-plz that doesn't involve that action to pin the hash.

Will your PR only change the workflows directory or the action.yaml file too?

I'm also happy to help you maintain this action if you trust me and give me some maintenance permissions 😁

I trust you since you already maintain a lot of stuff! But right now the action doesn't need that much maintenance I believe 🤔
And it's very important so I would like to review every PR that is merged eventually
But feel free to review PRs or reply to issues! It would be useful to have a second pair of eyes!

[Boshen]

I see the problem. I'll keep a fork of this action for now.