chore: Add Renovate config and pin GitHub Action versions to full semver (#387)

Author: jsonbailey

.github/renovate.json

@@ -0,0 +1,7 @@
+{
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
+  "vulnerabilityAlerts": {
+    "enabled": true
+  },
+  "osvVulnerabilityAlerts": true
+}

.github/workflows/build-gem.yml

@@ -23,7 +23,7 @@ jobs:
       FLAKY: ${{ startsWith(inputs.version, 'jruby') && 'true' || 'false' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
       - uses: launchdarkly/gh-actions/actions/persistent-stores@persistent-stores-v0
         with:
@@ -43,7 +43,7 @@ jobs:
       - name: Build gemspec
         run: gem build launchdarkly-server-sdk.gemspec --platform=$BUILD_PLATFORM
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4.6.2
         if: ${{ inputs.upload-artifact }}
         with:
           name: gems-${{ inputs.version }}

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
       - uses: ./.github/actions/setup
         with:
@@ -42,7 +42,7 @@ jobs:
         shell: powershell
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
       - uses: ./.github/actions/setup
         with:

.github/workflows/manual-publish-docs.yml

@@ -10,7 +10,7 @@ jobs:
       contents: write # Needed in this case to write github pages.
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
       - uses: ./.github/actions/setup
         with:

.github/workflows/manual-publish.yml

@@ -28,7 +28,7 @@ jobs:
       attestations: write # Needed for actions/attest.
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
       - uses: ./.github/actions/setup
         with:
@@ -56,6 +56,6 @@ jobs:
 
       - name: Attest build provenance
         if: ${{ format('{0}', inputs.dry_run) == 'false' }}
-        uses: actions/attest@v4
+        uses: actions/attest@v4.1.0
         with:
           subject-path: 'launchdarkly-server-sdk-*.gem'

.github/workflows/release-please.yml

@@ -45,7 +45,7 @@ jobs:
       attestations: write # Needed for actions/attest.
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
       - uses: ./.github/actions/setup
         with:
@@ -70,6 +70,6 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Attest build provenance
-        uses: actions/attest@v4
+        uses: actions/attest@v4.1.0
         with:
           subject-path: 'launchdarkly-server-sdk-*.gem'