From 083194f0e8ff7b2a64b5e396a34df3cf283e531a Mon Sep 17 00:00:00 2001
From: correctmost <134317971+correctmost@users.noreply.github.com>
Date: Sat, 22 Mar 2025 19:14:05 -0400
Subject: [PATCH] Pin astral-sh/ruff-action to a specific commit (#3265)

The GitHub docs recommend pinning third-party actions to specific
commits for security hardening purposes.
---
 .github/workflows/ruff.yaml | 2 +-
 renovate.json               | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ruff.yaml b/.github/workflows/ruff.yaml
index ae7ac869..633cb311 100644
--- a/.github/workflows/ruff.yaml
+++ b/.github/workflows/ruff.yaml
@@ -5,4 +5,4 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
-            - uses: astral-sh/ruff-action@v3
+            - uses: astral-sh/ruff-action@9828f49eb4cadf267b40eaa330295c412c68c1f9  # v3.2.2
diff --git a/renovate.json b/renovate.json
index 5490c2b9..b290fdd6 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigests"
   ],
   "pre-commit": {
     "enabled": true