fix: enable pinGitHubActionDigests and add trusted orgs

[JacobPEvans]

Summary

• Enable pinGitHubActionDigests: Renovate will now automatically convert all GitHub Actions tag references to SHA-pinned digests org-wide, preventing tag-poisoning attacks (addresses CVE-2026-33634)
• Add 5 new trusted orgs: aquasecurity, terraform-linters, lycheeverse, streetsidesoftware, oven-sh — enables faster auto-merge for security/lint tooling updates from these verified publishers
• Add npx regex manager: Custom regex manager detects and updates npx version pins in GitHub Actions workflow YAML files annotated with renovate comments

Test plan

• Verify Renovate picks up the new pinGitHubActionDigests setting and begins opening SHA-pin PRs across org repos
• Confirm new trusted orgs appear in Renovate's auto-merge scope (check next dependency update PRs from these orgs)
• Validate npx regex manager matches annotated npx calls in existing workflow files (dry-run Renovate locally or wait for next scheduled run)

🤖 Generated with Claude Code

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the Renovate configuration to improve both security and automation efficiency. By enforcing digest pinning for GitHub Actions and expanding the list of trusted publishers, the changes ensure a more secure and streamlined dependency management process across the organization's repositories.

Highlights

• Security Hardening: Enabled pinGitHubActionDigests to enforce SHA-pinned digests for GitHub Actions, mitigating potential tag-poisoning risks.
• Expanded Trusted Organizations: Added five new organizations (aquasecurity, terraform-linters, lycheeverse, streetsidesoftware, and oven-sh) to the trusted list to facilitate faster auto-merging of dependency updates.
• Custom Regex Manager: Introduced a new regex manager to detect and track npx version pins within GitHub Actions workflow files.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

To keep our workflows safe and sound, With SHA-pinned digests, we are bound. New trusted orgs now join the fray, To speed our updates on their way.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[Copilot]

Pull request overview

Enables stronger Renovate supply-chain hardening by SHA-pinning GitHub Actions, expands the “trusted orgs” allowlist for broader auto-merge coverage, and introduces a regex manager to update npx-pinned versions in GitHub Actions workflows.

Changes:

• Enable pinGitHubActionDigests to convert GitHub Actions tag references to SHA digests.
• Add aquasecurity, terraform-linters, lycheeverse, streetsidesoftware, oven-sh to the trusted org auto-merge allowlist.
• Add a custom regex manager to detect and update annotated npx version pins in workflow YAML.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.