Merge pull request #13 from seanconroy2021/EC-205

Automate dependency and image updates in GitHub Actions using Renovat…

.github/renovate.json

@@ -0,0 +1,17 @@
+  {
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["config:base"],
+    "timezone": "America/New_York",
+    "schedule": ["before 10pm"],
+    "automerge": true,
+    "automergeType": "pr",
+    "platformAutomerge": true,
+    "pinDigests": true,
+    "customManagers": [
+      {
+        "fileMatch": ["^\\.github/workflows/checks.yaml$"],
+        "matchStrings": ["image:\\s+(?<depName>ghcr\\.io/.*?):(?<currentValue>.*?)@(?<currentDigest>.*?)\\s"],
+        "datasourceTemplate": "docker"
+      }
+    ]
+  }

.github/workflows/checks.yaml

@@ -20,7 +20,7 @@ jobs:
     - name : Run EC Validate (keyless)
       uses: ./
       with:
-        image: ghcr.io/enterprise-contract/golden-container:latest
+        image: ghcr.io/enterprise-contract/golden-container:latest@sha256:bee6221c769593e9d01833a8b42d771f8610d30d87b56e3d8d016e13ff33477c
         identity: https:\/\/github\.com\/(slsa-framework\/slsa-github-generator|enterprise-contract\/golden-container)\/
         issuer: https://token.actions.githubusercontent.com
 

action.yaml

@@ -31,7 +31,7 @@ runs:
 
   steps:
     - name: Run EC Validate
-      uses: docker://quay.io/hacbs-contract/ec-cli:snapshot
+      uses: docker://quay.io/hacbs-contract/ec-cli:snapshot@sha256:fa09380c91a30f01ab26765d403f72a59e073e874abf9160b79d8167c8307a3f
       id: ec_validate
       continue-on-error: true
       with: