helpers:pinGitHubActionDigestsToSemver causes some actions to be skipped with "skipReason": "invalid-value"

[amezin]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

I'm trying to use helpers:pinGitHubActionDigestsToSemver. When I add it to extends together with a preset that pins everything, like :pinAllExceptPeerDependencies, actions github/codeql-action/init and github/codeql-action/analyze disappear from Dependency Dashboard, and in the log they have "skipReason": "invalid-value". So any updates for codeql-action stop, it's not just "not pinning" like in #27194.

Reproduction: https://github.com/amezin/renovate-pin-actions-digest-semver-codeql

Logs (if relevant)

Logs

DEBUG: packageFiles with updates
{
  "baseBranch": "main"
  "config": {
    "github-actions": [
      {
        "deps": [
          {
            "autoReplaceStringTemplate": "{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}",
            "commitMessageTopic": "{{{depName}}} action",
            "currentValue": "v4",
            "currentVersion": "v4.0.0",
            "currentVersionAgeInDays": 596,
            "currentVersionTimestamp": "2023-10-17T15:38:19.000Z",
            "datasource": "github-tags",
            "depName": "actions/checkout",
            "depType": "action",
            "fixedVersion": "v4",
            "isSingleVersion": true,
            "packageName": "actions/checkout",
            "registryUrl": "https://github.com",
            "replaceString": "actions/checkout@v4",
            "sourceUrl": "https://github.com/actions/checkout",
            "versioning": "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$",
            "warnings": [],
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "v4.2.2",
                "newValue": "v4.2.2",
                "newDigest": "11bd71901bbe5b1630ceea73d27597364c9af683",
                "releaseTimestamp": "2024-10-23T14:24:28.000Z",
                "newVersionAgeInDays": 224,
                "newMajor": 4,
                "newMinor": 2,
                "newPatch": 2,
                "updateType": "minor",
                "isBreaking": false,
                "libYears": 1.0162978500761035,
                "branchName": "renovate/actions-checkout-4.x"
              },
              {
                "isPinDigest": true,
                "updateType": "pinDigest",
                "newValue": "v4",
                "newDigest": "11bd71901bbe5b1630ceea73d27597364c9af683",
                "branchName": "renovate/pin-dependencies"
              }
            ]
          },
          {
            "autoReplaceStringTemplate": "{{depName}}/init@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}",
            "commitMessageTopic": "{{{depName}}} action",
            "currentValue": "v3",
            "datasource": "github-tags",
            "depName": "github/codeql-action",
            "depType": "action",
            "mostRecentTimestamp": "2025-06-03T13:08:51.000Z",
            "packageName": "github/codeql-action",
            "registryUrl": "https://github.com",
            "replaceString": "github/codeql-action/init@v3",
            "skipReason": "invalid-value",
            "sourceUrl": "https://github.com/github/codeql-action",
            "versioning": "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$",
            "warnings": [],
            "updates": []
          },
          {
            "autoReplaceStringTemplate": "{{depName}}/analyze@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}",
            "commitMessageTopic": "{{{depName}}} action",
            "currentValue": "v3",
            "datasource": "github-tags",
            "depName": "github/codeql-action",
            "depType": "action",
            "mostRecentTimestamp": "2025-06-03T13:08:51.000Z",
            "packageName": "github/codeql-action",
            "registryUrl": "https://github.com",
            "replaceString": "github/codeql-action/analyze@v3",
            "skipReason": "invalid-value",
            "sourceUrl": "https://github.com/github/codeql-action",
            "versioning": "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$",
            "warnings": [],
            "updates": []
          },
          {
            "autoReplaceStringTemplate": "{{depName}}-{{newValue}}",
            "currentValue": "latest",
            "datasource": "github-runners",
            "depName": "ubuntu",
            "depType": "github-runner",
            "packageName": "ubuntu",
            "replaceString": "ubuntu-latest",
            "skipReason": "invalid-version",
            "updates": []
          }
        ],
        "packageFile": ".github/workflows/codeql.yml"
      }
    ]
  }
}

[amezin]

But if I do this instead of using the preset:

  "packageRules": [
    {
      "extends": ["helpers:pinGitHubActionDigests"],
      "rangeStrategy": "pin",
      "versioning": "semver-coerced"
    }
  ]

everything seems to work perfectly: amezin/create-commit-action#55 (well, it's still not recognized as "pinning", but at least it updates). So I wonder why does the preset look like this instead.

[amezin]

It seems that semver-coerced works better because it can discard mismatching prefix. But in the logs it's just "currentValue": "v3".

[amezin]

Oh, I was wrong. github/codeql-action (without subdirectory) has the same problem too.

The reason is actually that codeql-action has no v3.0.0 tag

Also, assigning npm versioning works actually perfectly - pinning is recognized as pinning amezin/create-commit-action#58 and also grouped together with digest pinning amezin/renovate-pin-actions-digest-semver-codeql#4.