Don't SHA-pin internal trufflesecurity actions/reusable workflows

[bryanbeverly]

Summary

• Add a packageRule to the shared base preset (renovate-config.json) that disables digest pinning (pinDigests: false) for internal trufflesecurity/* actions and reusable workflows.
• This stops helpers:pinGitHubActionDigests from pinning internal refs that are intentionally kept on floating refs (e.g. @main).

Motivation

helpers:pinGitHubActionDigests (in this preset) pins every github-actions ref, including internal trufflesecurity reusable workflows. Per the Dependency Strategy Unification plan's Design Decision #1, internal actions are intentionally not SHA-pinned: they're org-controlled (internal supply chain), and pinning them just adds Renovate noise on every internal release. Step 2's manual pin-github-action run honored this via --allow "trufflesecurity/*", but the Renovate preset had no equivalent carve-out.

This surfaced as trufflesecurity/truffle-release-bot#25 ("Pin dependencies"), where Renovate tried to pin three trufflesecurity/.github reusable-workflow refs from @main to a SHA.

Why a regex, not a glob

Renovate names a reusable-workflow dependency after its repo, not the full workflow path. The Dependency Dashboard for truffle-release-bot confirms the depName is trufflesecurity/.github (not trufflesecurity/.github/.github/workflows/pr-labeler-reusable.yml). The leading dot in .github defeats glob * matching (minimatch doesn't match a leading dot by default), so a trufflesecurity/* glob would silently skip it.

This is the same silent-failure mode fixed in slack-integration-service#568 (SCAN-914), where a non-matching matchDepNames opt-out let the bot re-pin a ref that had to stay on @main. Using a regex (/^trufflesecurity\//) sidesteps the dot semantics entirely.

Change

{
  "matchManagers": ["github-actions"],
  "matchDepNames": ["/^trufflesecurity\\//"],
  "pinDigests": false
}

Test plan

• Trigger a Renovate dry-run (or check a downstream repo's next run) and confirm internal trufflesecurity/* reusable-workflow refs are no longer proposed for digest pinning, while third-party actions still are.
• Confirm truffle-release-bot#25 is no longer regenerated after the next Renovate cycle.
• Tag a new preset version (e.g. v1.0.3) after validation so high-risk repos pick it up.

Made with Cursor