From d06a526820917c022142ad9cc1019c16113fa250 Mon Sep 17 00:00:00 2001
From: Dan Lemon <daniel.lemon@amazee.io>
Date: Wed, 5 Aug 2026 22:58:35 +0200
Subject: [PATCH] chore: weekly renovate schedule, pin GitHub actions to SHAs

---
 .github/workflows/drupal-example.yaml | 2 +-
 .github/workflows/merge-branch.yaml   | 4 ++--
 renovate.json                         | 7 ++++++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/drupal-example.yaml b/.github/workflows/drupal-example.yaml
index 36029bb..39b9ec9 100644
--- a/.github/workflows/drupal-example.yaml
+++ b/.github/workflows/drupal-example.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: "0"
     - name: Report versions
diff --git a/.github/workflows/merge-branch.yaml b/.github/workflows/merge-branch.yaml
index 8233522..6d9dc9f 100644
--- a/.github/workflows/merge-branch.yaml
+++ b/.github/workflows/merge-branch.yaml
@@ -7,10 +7,10 @@ jobs:
   sync-branch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Merge main -> versioned
-        uses: devmasx/merge-branch@master
+        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # v1.4.0
         with:
           type: now
           from_branch: main
diff --git a/renovate.json b/renovate.json
index 06c4939..8582afe 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,10 +1,15 @@
 {
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "baseBranchPatterns": [
     "main",
     "versioned"
   ],
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "schedule": [
+    "before 6am on monday"
   ],
   "automerge": true,
   "automergeType": "pr",