Pin GitHub Actions digests via renovate

renovate.json

@@ -8,6 +8,15 @@
   "postUpdateOptions": ["gomodTidy"],
   "prConcurrentLimit": 5,
   "packageRules": [
+    {
+      "matchDepTypes": ["action"],
+      "pinDigests": true
+    },
+    {
+      "extends": ["helpers:pinGitHubActionDigests"],
+      "extractVersion": "^(?<version>v?\\d+\\.\\d+\\.\\d+)$",
+      "versioning": "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$"
+    },
     {
       "matchUpdateTypes": ["patch"],
       "automerge": true,