.github/renovate.json5

@@ -4,38 +4,94 @@
     "config:recommended",
     "schedule:weekly",
     "group:allNonMajor",
-    ":disablePeerDependencies", 
+    ":disablePeerDependencies",
     "regexManagers:biomeVersions",
+    "helpers:pinGitHubActionDigestsToSemver"
+  ],
+  "labels": [
+    "dependencies"
   ],
-  "labels": ["dependencies"],
   "rangeStrategy": "bump",
-  "postUpdateOptions": ["pnpmDedupe"],
-  "ignorePaths": ["**/node_modules/**"],
+  "postUpdateOptions": [
+    "pnpmDedupe"
+  ],
+  "ignorePaths": [
+    "**/node_modules/**"
+  ],
   "packageRules": [
     // TODO: remove once the tailwind integration is removed
     {
-      "matchPackageNames": ["tailwindcss"],
-      "ignorePaths": ["packages/integrations/tailwind"]
+      "matchPackageNames": [
+        "tailwindcss"
+      ],
+      "ignorePaths": [
+        "packages/integrations/tailwind"
+      ]
+    },
+    {
+      "groupName": "github-actions",
+      "matchManagers": [
+        "github-actions"
+      ]
+    },
+    {
+      "groupName": "astro dependencies",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "packages/astro/**",
+        "packages/integrations/mdx/**",
+        "packages/integrations/remark/**",
+      ]
+    },
+    {
+      "groupName": "astro adapters",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "packages/integrations/node/**",
+        "packages/integrations/netlify/**",
+        "packages/integrations/cloudflare/**",
+        "packages/integrations/vercel/**",
+      ]
+    },
+    {
+      "groupName": "astro client runtimes",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "packages/integrations/react/**",
+        "packages/integrations/solid/**",
+        "packages/integrations/preact/**",
+        "packages/integrations/svelte/**",
+        "packages/integrations/vue/**",
+      ]
     }
   ],
   "ignoreDeps": [
     // manually bumping deps
     "@biomejs/biome",
     "@types/node",
-    "astro-embed", // TODO: investigate upgrade (zod import issues with atproto)
-    "drizzle-orm", // TODO: investigate upgrade (has type issues)
+
+    // TODO: investigate upgrade (zod import issues with atproto)
+    "astro-embed",
+
+    // TODO: investigate upgrade (has type issues)
+    "drizzle-orm",
     "sharp",
-
     // manually bumping workflow actions
     "actions/labeler",
-
     // ignore "engines" update
     "node",
     "npm",
     "pnpm",
-
     // follow vite deps version
     "postcss-load-config",
     "esbuild",
+    // TODO: follow https://github.com/withastro/astro/pull/13478
+    "@vitejs/plugin-vue"
   ],
 }

.github/workflows/benchmark.yml

@@ -21,23 +21,23 @@ jobs:
       MAIN-BENCH: ${{ steps.benchmark-main.outputs.BENCH_RESULT }}
     steps:
       - name: Check if user has write access
-        uses: lannonbr/repo-permission-check-action@2.0.2
+        uses: lannonbr/repo-permission-check-action@2bb8c89ba8bf115c4bfab344d6a6f442b24c9a1f # 2.0.2
         with:
           permission: write
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # https://github.com/actions/checkout/issues/331#issuecomment-1438220926
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.issue.number }}/head
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -70,7 +70,7 @@ jobs:
         shell: bash
 
       # main benchmark
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: "main"
@@ -101,7 +101,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment PR
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         continue-on-error: true
         with:
           issue-number: ${{ github.event.issue.number }}

.github/workflows/check-merge.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Check if there is already a block on this PR
         id: blocked
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         env:
           issue_number:  ${{ github.event.number }}
         with:
@@ -32,7 +32,7 @@ jobs:
             return 'false'
           result-encoding: string
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         if: steps.blocked.outputs.result != 'true'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -41,7 +41,7 @@ jobs:
 
       - name: Get changed files in the .changeset folder
         id: changed-files
-        uses: tj-actions/changed-files@v45
+        uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
         if: steps.blocked.outputs.result != 'true'
         with:
           files: |
@@ -67,7 +67,7 @@ jobs:
           done
 
       - name: Add label
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         if: steps.check.outputs.found == 'true'
         env:
           issue_number: ${{ github.event.number }}
@@ -81,7 +81,7 @@ jobs:
             });
 
       - name: Change PR Status
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         if: steps.check.outputs.found == 'true'
         env:
           issue_number: ${{ github.event.number }}

.github/workflows/check.yml

@@ -28,13 +28,13 @@ jobs:
     timeout-minutes: 7
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"

.github/workflows/ci.yml

@@ -47,13 +47,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -77,13 +77,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -122,13 +122,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -159,13 +159,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -195,19 +195,19 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
 
       - name: Checkout docs
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: withastro/docs
           path: smoke/docs
@@ -232,7 +232,7 @@ jobs:
 
       - name: Check if docs changed
         id: changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             docs:

.github/workflows/cleanup-cache.yml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Cleanup caches older than 5 days
         if: github.event_name == 'schedule'
-        uses: MyAlbum/purge-cache@v2
+        uses: MyAlbum/purge-cache@881eb5957687193fa612bf74c0042adc78ea5e54 # v2.2.0
         with:
           max-age: 432000
 

.github/workflows/continuous_benchmark.yml

@@ -29,13 +29,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -47,7 +47,7 @@ jobs:
         run: pnpm run build
 
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@63ae6025a0ffee97d7736a37c9192dbd6ed4e75f # v3.4.0
+        uses: CodSpeedHQ/action@0010eb0ca6e89b80c88e8edaaa07cfe5f3e6664d # v3.5.0
         timeout-minutes: 30
         with:
           working-directory: ./benchmark

.github/workflows/examples-deploy.yml

@@ -15,7 +15,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Send a POST request to Netlify to rebuild preview.astro.new
         run: 'curl -X POST -d {} ${{ env.BUILD_HOOK }}'
         env:

.github/workflows/issue-labeled.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: remove triage
         if: contains(github.event.label.description, '(priority)') && contains(github.event.issue.labels.*.name, 'needs triage')
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "remove-labels"
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -20,7 +20,7 @@ jobs:
 
       - name: needs repro
         if: github.event.label.name == 'needs repro'
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "create-comment, remove-labels"
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -30,7 +30,7 @@ jobs:
           labels: "needs triage"
       - name: wontfix
         if: github.event.label.name == 'wontfix'
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "create-comment, close-issue"
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-needs-repro.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: needs repro
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "close-issues"
           token: ${{ secrets.GITHUB_TOKEN }}