Caution

This PR upgrades Kong/public-shared-actions sub-action to v4+ and pins it to the commit digest. It is prioritized (bypasses schedules/rate limits).

Closing this PR will not stop it; Renovate will automatically reopen or recreate it until it is merged.

Mandatory upgrade to v4+ with automatic digest pinning for Kong/public-shared-actions

Renovate is configured to upgrade any Kong/public-shared-actions sub-action still on versions below 4 to the latest v4+ version. As part of this upgrade, it will automatically pin each reference to the exact commit digest (and keep that digest refreshed over time).

Background

The Kong/public-shared-actions monorepo now publishes per-sub-action tags in the form <sub-action>@<version> (for example, workflow-notification@4.0.1) instead of plain vX.Y.Z tags. Older references like ...@v2 cannot be auto-migrated by tag alone.

Why tag-only migration is not supported

Important: Renovate will not change the tag format for you. Migrating from the older plain vX.Y.Z tags to the new per-sub-action tags while keeping tag-only references would require rewriting refs such as ...@v2 to a different tag name like ...@sca@5.1.1. This contradicts the goal of dependency update automation because it relies on humans to manage tag-name changes and ongoing updates, which our automation is not designed to perform. For this reason, tag-only migration is not supported.

Instead, this preset enforces digest pinning. Renovate resolves releases by tag, then writes the reference as the commit SHA for that release with a trailing human-friendly comment (e.g., ...@<sha> # v5.1.1). Tracking commits rather than tag names keeps updates automated and robust even if tag naming conventions change.

Security

GitHub Actions security guidance recommends pinning third-party actions to a full commit SHA to protect against tag moving and supply-chain attacks.

References

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions