ci: pin varios actions to a proper semver version (#39)

Reviewed-on: #39
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

.gitea/actions/release-git-tag/action.yaml

@@ -1,15 +0,0 @@
-name: Release Git tag
-description: Release the Git tag
-
-inputs:
-  tag:
-    description: The tag to release
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - shell: bash
-      run: |
-        git tag ${{ inputs.tag }}
-        git push origin ${{ inputs.tag }}

.gitea/workflows/cd.yaml

@@ -4,20 +4,22 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.1.1
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@4c32e563bea346792d854585112bf6f06b312ce2 # 0.1.24
         with:
           token: ${{ secrets.GITEA_TOKEN }}
-      - uses: ./.gitea/actions/release-git-tag
+          prerelease: ${{ github.event_name == 'workflow_dispatch' }}
+      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8a04fa92474f770e525b1e6dd420b471da15c222 # 0.1.0
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -16,8 +16,8 @@ jobs:
           - "common.json"
           - "docker-compose.json"
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Validate "${{ matrix.json-file }}"
-        uses: https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action@0.1.2
+        uses: https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action@3e6f6900956d410f67923617c65f38a7efb228c6 # 0.1.2
         with:
           json-file: "./${{ matrix.json-file }}"

.gitea/workflows/prerelease.yaml

@@ -1,22 +0,0 @@
-name: Prerelease
-
-on:
-  workflow_dispatch:
-
-jobs:
-  prerelease:
-    name: Prerelease
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-        with:
-          fetch-depth: 0
-      - name: Increment tag
-        id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.1.1
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
-          prerelease: true
-      - uses: ./.gitea/actions/release-git-tag
-        with:
-          tag: ${{ steps.tag.outputs.new-tag }}

action.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["helpers:pinGitHubActionDigests"],
+  "extends": ["local>t.behrendt/renovate-configs:common", "helpers:pinGitHubActionDigests"],
   "packageRules": [
     {
       "matchManagers": ["github-actions"],

common.json

@@ -1,5 +1,19 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "dependencyDashboard": true,
-  "semanticCommits": "enabled"
+  "semanticCommits": "enabled",
+  "extends": ["config:best-practices", ":semanticCommitTypeAll(chore)"],
+  "packageRules": [
+    {
+      "description": "Don't update dependencies unless they are at least 7 days old",
+      "minimumReleaseAge": "7 days",
+      "minimumReleaseAgeBehaviour": "timestamp-required",
+      "internalChecksFilter": "strict"
+    },
+    {
+      "description": "Exempt local dependencies from the minimum release age",
+      "matchPackageNames": ["/^(https:\\/\\/)?gitea\\.t000-n\\.de/"],
+      "minimumReleaseAge": null
+    }
+  ]
 }

docker-compose.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>t.behrendt/renovate-configs:common"],
   "docker-compose": {
     "digest": {
       "enabled": true

helm.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>t.behrendt/renovate-configs:common"],
   "helm-values": {
     "fileMatch": ["(^|/)values/.*\\.ya?ml$", "(^|/)values/.*\\.ya?ml\\.gotmpl$"]
   },

k8s.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>t.behrendt/renovate-configs:common"],
   "kubernetes": {
     "enabled": true,
     "labels": ["deps", "k8s"]

renovate.json

@@ -1,7 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>t.behrendt/renovate-configs:common",
     "local>t.behrendt/renovate-configs:action"
   ]
 }