Is there a way to replicate GitHub Actions manager Digest pinning using regexManager?

[budimanjojo]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

46.1.15

Please tell us more about your question or problem

Hello, I'm trying to replicate the digest pinning on GitHub Actions manager (https://docs.renovatebot.com/modules/manager/github-actions/#digest-pinning-and-updating) but not from a YAML file. I'm thinking about using a custom Regex manager (https://docs.renovatebot.com/modules/manager/regex/)?

Wanting to confirm if this is even possible.

The reason of me needing this is because I use another tool to generate the GitHub workflows files for me instead of manually writing the yaml files. The tool is github-actions.nix. Basically it is a tool that convert Nix code into a YAML file that can be consumed by GitHub.

I know it is possible if I just pin the version without the digest, but that means I'll be more prone to get compromised by similar to the recent tj-actions/changed-files attack.

Not wanting to complicate my question, so I'll just give an example code that I want to achieve. Basically, I want to create a custom regex manager (or something else that I'm not aware of) that can update a dependency like this:

{
  uses = "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"; # v7.0.0
}

Thanks before!

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[budimanjojo]

I managed to do it like this:

{
  "packageRules": [
    {
      "matchDepTypes": [ "action" ],
      "commitMessageTopic": "{{{depName}}} action"
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": [
        "github-actions\\/dependencies.nix"
      ],
      "matchStrings": [
        "\"(?<depName>[a-zA-Z0-9\\/-]*)@(?<currentDigest>[a-f0-9]{40})\";\\s*#\\s*(?<currentValue>[^\\r\\n]+)[\\r|\\n|$]",
        "\"(?<depName>[a-zA-Z0-9\\/-]*)@(?<currentValue>[^\"]+)\";[\\r|\\n|$]"
      ],
      "autoReplaceStringTemplate": "\"{{depName}}@{{#if newDigest}}{{newDigest}}\";{{#if newValue}} # {{newValue}}\n{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}\";\n{{/unless}}",
      "versioningTemplate": "github-actions",
      "depTypeTemplate": "action",
      "datasourceTemplate": "{{#if currentDigest}}github-digest{{else}}github-tags{{/if}}"
    }
  ]
}

2 matchStrings, one for version with digest ("actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"; # v7.0.0), and another one without digest ("actions/checkout@v7.0.0").