feat(github-action): Support updating digest pinned actions

lib/manager/github-actions/__fixtures__/workflow.yml.2 → lib/manager/github-actions/__fixtures__/workflow_2.yml

@@ -11,11 +11,12 @@ jobs:
         # Isn't supported current
         uses: actions/bin/shellcheck@master
         run: ./entrypoint.sh
+      - uses: docker/setup-qemu-action@c308fdd69d26ed66f4506ebd74b180abe5362145 # renovate: tag=v1.1.0
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@1.0.0
-#      - uses: docker/setup-qemu-action@v1
+      - uses: docker/setup-qemu-action@c308fdd69d26ed66f4506ebd74b180abe5362145
       - name: Build
         uses: docker/build-push-action@v2

lib/manager/github-actions/__snapshots__/extract.spec.ts.snap

@@ -12,6 +12,17 @@ Array [
     "skipReason": "invalid-version",
     "versioning": "docker",
   },
+  Object {
+    "commitMessageTopic": "{{{depName}}} action",
+    "currentDigest": "c308fdd69d26ed66f4506ebd74b180abe5362145",
+    "currentValue": "v1.1.0",
+    "datasource": "github-tags",
+    "depName": "docker/setup-qemu-action",
+    "depType": "action",
+    "pinDigests": false,
+    "replaceString": "      - uses: docker/setup-qemu-action@c308fdd69d26ed66f4506ebd74b180abe5362145 # renovate: tag=v1.1.0",
+    "versioning": "docker",
+  },
   Object {
     "commitMessageTopic": "{{{depName}}} action",
     "currentValue": "1.0.0",
@@ -21,6 +32,17 @@ Array [
     "pinDigests": false,
     "versioning": "docker",
   },
+  Object {
+    "commitMessageTopic": "{{{depName}}} action",
+    "currentDigest": "c308fdd69d26ed66f4506ebd74b180abe5362145",
+    "currentValue": undefined,
+    "datasource": "github-tags",
+    "depName": "docker/setup-qemu-action",
+    "depType": "action",
+    "pinDigests": false,
+    "replaceString": "      - uses: docker/setup-qemu-action@c308fdd69d26ed66f4506ebd74b180abe5362145",
+    "versioning": "docker",
+  },
   Object {
     "commitMessageTopic": "{{{depName}}} action",
     "currentValue": "v2",

lib/manager/github-actions/extract.spec.ts

@@ -1,8 +1,8 @@
 import { getName, loadFixture } from '../../../test/util';
 import { extractPackageFile } from './extract';
 
-const workflow1 = loadFixture('workflow.yml.1');
-const workflow2 = loadFixture('workflow.yml.2');
+const workflow1 = loadFixture('workflow_1.yml');
+const workflow2 = loadFixture('workflow_2.yml');
 
 describe(getName(), () => {
   describe('extractPackageFile()', () => {
@@ -19,7 +19,7 @@ describe(getName(), () => {
       expect(res.deps).toMatchSnapshot();
       expect(
         res.deps.filter((d) => d.datasource === 'github-tags')
-      ).toHaveLength(3);
+      ).toHaveLength(5);
     });
   });
 });

lib/manager/github-actions/extract.ts

@@ -5,6 +5,11 @@ import * as dockerVersioning from '../../versioning/docker';
 import { getDep } from '../dockerfile/extract';
 import type { PackageDependency, PackageFile } from '../types';
 
+const dockerRe = /^\s+uses: docker:\/\/([^"]+)\s*$/;
+const actionRe =
+  /^\s+-?\s+?uses: (?<depName>[\w-]+\/[\w-]+)(?<path>.*)?@(?<currentValue>.+?)(?: # renovate: tag=(?<tag>.+?))?\s*?$/;
+const sha256Re = /^[a-z0-9]{40}$/;
+
 export function extractPackageFile(content: string): PackageFile | null {
   logger.trace('github-actions.extractPackageFile()');
   const deps: PackageDependency[] = [];
@@ -13,7 +18,7 @@ export function extractPackageFile(content: string): PackageFile | null {
       continue; // eslint-disable-line no-continue
     }
 
-    const dockerMatch = /^\s+uses: docker:\/\/([^"]+)\s*$/.exec(line);
+    const dockerMatch = dockerRe.exec(line);
     if (dockerMatch) {
       const [, currentFrom] = dockerMatch;
       const dep = getDep(currentFrom);
@@ -23,25 +28,37 @@ export function extractPackageFile(content: string): PackageFile | null {
       continue; // eslint-disable-line no-continue
     }
 
-    const tagMatch =
-      /^\s+-?\s+?uses: (?<depName>[\w-]+\/[\w-]+)(?<path>.*)?@(?<currentValue>.+?)\s*?$/.exec(
-        line
-      );
+    const tagMatch = actionRe.exec(line);
     if (tagMatch?.groups) {
-      const { depName, currentValue } = tagMatch.groups;
-      const dep: PackageDependency = {
-        depName,
-        currentValue,
-        commitMessageTopic: '{{{depName}}} action',
-        datasource: githubTagsDatasource.id,
-        versioning: dockerVersioning.id,
-        depType: 'action',
-        pinDigests: false,
-      };
-      if (!dockerVersioning.api.isValid(currentValue)) {
-        dep.skipReason = SkipReason.InvalidVersion;
+      const { depName, currentValue, tag } = tagMatch.groups;
+      if (sha256Re.test(currentValue)) {
+        const dep: PackageDependency = {
+          depName,
+          currentValue: tag,
+          currentDigest: currentValue,
+          commitMessageTopic: '{{{depName}}} action',
+          datasource: githubTagsDatasource.id,
+          versioning: dockerVersioning.id,
+          depType: 'action',
+          pinDigests: false,
+          replaceString: line,
+        };
+        deps.push(dep);
+      } else {
+        const dep: PackageDependency = {
+          depName,
+          currentValue,
+          commitMessageTopic: '{{{depName}}} action',
+          datasource: githubTagsDatasource.id,
+          versioning: dockerVersioning.id,
+          depType: 'action',
+          pinDigests: false,
+        };
+        if (!dockerVersioning.api.isValid(currentValue)) {
+          dep.skipReason = SkipReason.InvalidVersion;
+        }
+        deps.push(dep);
       }
-      deps.push(dep);
     }
   }
   if (!deps.length) {

lib/manager/github-actions/readme.md

@@ -1 +1,17 @@
 The `github-actions` manager extracts dependencies from GitHub Actions workflow and workflow template files.
+
+If you like to use digest pinning but following the action version, you can use the following sample:
+
+```yaml
+name: build
+
+on: [push]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@af513c7a016048ae468971c52ed77d9562c7c819 # renovate: tag=v1.0.0
+```
+
+So renovate will update the commit sha but follow the github tag you specified.