docs(renovate): exempt org-owned actions from digest pinning (last-match-wins)#123
Conversation
…tch-wins) Renovate applies the last matching packageRule, so a netresearch/** pin exemption in a shared preset is overridden when a repo extends helpers:pinGitHubActionDigests after it — SHA-pinning org-owned reusable workflows meant to track a branch. Document the repo-level rule and a bundled :pinning sub-preset that applies the exemption last. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
github-actions
Bot
added
documentation
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the dependency management documentation by adding a new section on GitHub Actions digest pinning. It explains how Renovate's last-match-wins rule evaluation can override exemptions for org-owned resources and provides repo-level and org-wide configuration examples to correctly handle these exemptions. There are no review comments, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Learning from a session where Renovate auto-merged PRs that SHA-pinned an
org/.githubreusable workflow against org policy.dependency-management.md(Renovate): Renovate applies the last matchingpackageRule, so amyorg/**pin-exemption placed only in a shared preset is silently overridden when a repo extendshelpers:pinGitHubActionDigestsafter it — and Renovate SHA-pins org-owned reusable workflows that are meant to track a branch (so fixes reach consumers without per-repo digest bumps).Added a subsection documenting the two places the exemption actually wins:
packageRules(evaluated after allextends), and:pinningsub-preset that extends the pin preset then applies the exemption last, so consumers can't omit or mis-order it.