Pin dependencies (forgejo) (#12923)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://data.forgejo.org/actions/cache](https://github.com/actions/cache) | action | pin | `v5` → `v5.0.5` |
| [https://data.forgejo.org/actions/cascading-pr](https://code.forgejo.org/actions/cascading-pr) | action | pinDigest |  → `b52d5b1` |
| [https://data.forgejo.org/actions/checkout](https://github.com/actions/checkout) | action | pin | `v6` → `v6.0.3` |
| [https://data.forgejo.org/actions/git-backporting](https://code.forgejo.org/actions/git-backporting) | action | pinDigest |  → `08da0b0` |
| [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | pinDigest |  → `650f7cf` |
| [https://data.forgejo.org/actions/setup-go](https://github.com/actions/setup-go) | action | pin | `v6` → `v6.4.0` |
| [https://data.forgejo.org/actions/setup-node](https://github.com/actions/setup-node) | action | pin | `v6` → `v6.4.0` |
| [https://data.forgejo.org/forgejo/forgejo-build-publish](https://code.forgejo.org/forgejo/forgejo-build-publish) | action | pinDigest |  → `970e852` |
| [https://data.forgejo.org/forgejo/set-milestone](https://code.forgejo.org/forgejo/set-milestone) | action | pinDigest |  → `4010c1a` |
| [https://data.forgejo.org/forgejo/upload-artifact](https://code.forgejo.org/forgejo/upload-artifact) | action | pin | `v5` → `v5` |
| [https://data.forgejo.org/infrastructure/issue-action](https://code.forgejo.org/infrastructure/issue-action) | action | pinDigest |  → `c668390` |
| [https://data.forgejo.org/infrastructure/next-digest](https://code.forgejo.org/infrastructure/next-digest) | action | pinDigest |  → `e220261` |
| [https://data.forgejo.org/tj-actions/changed-files](https://github.com/tj-actions/changed-files) | action | pin | `v47` → `v47.0.6` |

Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDguMiIsInVwZGF0ZWRJblZlciI6IjQzLjIwOC4yIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12923
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>

.forgejo/workflows-composite/build-backend/action.yaml

@@ -3,7 +3,7 @@ runs:
   steps:
     - run: |
         su forgejo -c 'make deps-backend'
-    - uses: https://data.forgejo.org/actions/cache@v5
+    - uses: https://data.forgejo.org/actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       id: cache-backend
       with:
         path: ${{github.workspace}}/gitea

.forgejo/workflows-composite/setup-cache-go/action.yaml

@@ -17,7 +17,7 @@ runs:
         apt-get -q install -qq -y zstd
 
     - name: "Set up Go using setup-go"
-      uses: https://data.forgejo.org/actions/setup-go@v6
+      uses: https://data.forgejo.org/actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       id: go-version
       with:
         go-version-file: "go.mod"
@@ -50,7 +50,7 @@ runs:
 
     - name: "Restore Go dependencies from cache or mark for later caching"
       id: cache-deps
-      uses: https://data.forgejo.org/actions/cache@v5
+      uses: https://data.forgejo.org/actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         key: setup-cache-go-deps-${{ runner.os }}-${{ inputs.username }}-${{ steps.go-version.outputs.go_version }}-${{ hashFiles('go.sum', 'go.mod', 'Makefile') }}
         restore-keys: |

.forgejo/workflows/backport.yml

@@ -47,7 +47,7 @@ jobs:
           cat <<'EOF'
           ${{ toJSON(github) }}
           EOF
-      - uses: https://data.forgejo.org/actions/git-backporting@v4.9.1
+      - uses: https://data.forgejo.org/actions/git-backporting@08da0b07ef2330d189f6074ec8db736b3aa9f465 # v4.9.1
         with:
           target-branch-pattern: "^backport/(?<target>(v.*))$"
           strategy: ort

.forgejo/workflows/build-release-integration.yml

@@ -29,10 +29,10 @@ jobs:
     if: vars.ROLE == 'forgejo-coding'
     runs-on: lxc-bookworm
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - id: forgejo
-        uses: https://data.forgejo.org/actions/setup-forgejo@v3.1.12
+        uses: https://data.forgejo.org/actions/setup-forgejo@650f7cf6349e074eac2c5b47d3fd23acba12fb54 # v3.1.12
         with:
           user: root
           password: admin1234

.forgejo/workflows/build-release.yml

@@ -33,7 +33,7 @@ jobs:
     # root is used for testing, allow it
     if: vars.ROLE == 'forgejo-integration' || github.repository_owner == 'root'
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
@@ -43,11 +43,11 @@ jobs:
           repository="${{ github.repository }}"
           echo "value=${repository##*/}" >> "$GITHUB_OUTPUT"
 
-      - uses: https://data.forgejo.org/actions/setup-node@v6
+      - uses: https://data.forgejo.org/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
 
-      - uses: https://data.forgejo.org/actions/setup-go@v6
+      - uses: https://data.forgejo.org/actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: "go.mod"
 
@@ -93,7 +93,7 @@ jobs:
 
       - name: cache node_modules
         id: node
-        uses: https://data.forgejo.org/actions/cache@v5
+        uses: https://data.forgejo.org/actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: |
             node_modules
@@ -164,7 +164,7 @@ jobs:
 
       - name: build container & release
         if: ${{ secrets.TOKEN != '' }}
-        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.7.0
+        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@970e852f5ce41d5821b62b9137c4ff4966c9a3d1 # v5.7.0
         with:
           forgejo: "${{ env.GITHUB_SERVER_URL }}"
           owner: "${{ env.GITHUB_REPOSITORY_OWNER }}"
@@ -183,7 +183,7 @@ jobs:
 
       - name: build rootless container
         if: ${{ secrets.TOKEN != '' }}
-        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.7.0
+        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@970e852f5ce41d5821b62b9137c4ff4966c9a3d1 # v5.7.0
         with:
           forgejo: "${{ env.GITHUB_SERVER_URL }}"
           owner: "${{ env.GITHUB_REPOSITORY_OWNER }}"
@@ -201,7 +201,7 @@ jobs:
 
       - name: end-to-end tests
         if: ${{ secrets.TOKEN != '' && vars.ROLE == 'forgejo-integration' && vars.SKIP_END_TO_END != 'true' }}
-        uses: https://data.forgejo.org/actions/cascading-pr@v2.3.2
+        uses: https://data.forgejo.org/actions/cascading-pr@b52d5b1f4f7bc3dd8b9f6ceca3a05aea6e9920be # v2.3.2
         with:
           origin-url: ${{ env.GITHUB_SERVER_URL }}
           origin-repo: ${{ github.repository }}

.forgejo/workflows/cascade-setup-end-to-end.yml

@@ -37,11 +37,11 @@ jobs:
     container:
       image: data.forgejo.org/oci/node:24-trixie
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: '0'
           show-progress: 'false'
-      - uses: https://data.forgejo.org/actions/cascading-pr@v2.3.2
+      - uses: https://data.forgejo.org/actions/cascading-pr@b52d5b1f4f7bc3dd8b9f6ceca3a05aea6e9920be # v2.3.2
         with:
           origin-url: ${{ env.GITHUB_SERVER_URL }}
           origin-repo: ${{ github.repository }}

.forgejo/workflows/coverage.yml

@@ -61,7 +61,7 @@ jobs:
         image: registry.redict.io/redict:7.3.6-scratch
         options: --tmpfs /data:noatime
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.ref }}

.forgejo/workflows/milestone.yml

@@ -15,7 +15,7 @@ jobs:
     container:
       image: 'data.forgejo.org/oci/ci:2'
     steps:
-      - uses: https://data.forgejo.org/forgejo/set-milestone@v1.0.0
+      - uses: https://data.forgejo.org/forgejo/set-milestone@4010c1a99aa87eed8acd94064b4fa93f675ba561 # v1.0.0
         with:
           forgejo: https://codeberg.org
           repository: forgejo/forgejo

.forgejo/workflows/publish-release.yml

@@ -41,10 +41,10 @@ jobs:
     runs-on: lxc-bookworm
     if: vars.DOER != '' && vars.FORGEJO != '' && vars.TO_OWNER != '' && vars.FROM_OWNER != '' && secrets.TOKEN != ''
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: copy & sign
-        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.7.0
+        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@970e852f5ce41d5821b62b9137c4ff4966c9a3d1 # v5.7.0
         with:
           from-forgejo: ${{ vars.FORGEJO }}
           to-forgejo: ${{ vars.FORGEJO }}
@@ -63,14 +63,14 @@ jobs:
 
       - name: get trigger mirror issue
         id: mirror
-        uses: https://data.forgejo.org/infrastructure/issue-action/get@v1.5.0
+        uses: https://data.forgejo.org/infrastructure/issue-action/get@c66839063e70625ad4306aeb038c2a5e899af840 # v1.5.0
         with:
           forgejo: https://code.forgejo.org
           repository: forgejo/forgejo
           labels: mirror-trigger
 
       - name: trigger the mirror
-        uses: https://data.forgejo.org/infrastructure/issue-action/set@v1.5.0
+        uses: https://data.forgejo.org/infrastructure/issue-action/set@c66839063e70625ad4306aeb038c2a5e899af840 # v1.5.0
         with:
           forgejo: https://code.forgejo.org
           repository: forgejo/forgejo
@@ -80,7 +80,7 @@ jobs:
           label: trigger
 
       - name: upgrade v*.next.forgejo.org
-        uses: https://data.forgejo.org/infrastructure/next-digest@v1.2.2
+        uses: https://data.forgejo.org/infrastructure/next-digest@e22026170bac6fd38c3034dbc33e66b52fe069d1 # v1.2.2
         with:
           url: https://placeholder:${{ secrets.TOKEN_NEXT_DIGEST }}@invisible.forgejo.org/infrastructure/next-digest
           ref_name: '${{ github.ref_name }}'

.forgejo/workflows/release-notes-assistant-milestones.yml

@@ -15,9 +15,9 @@ jobs:
     container:
       image: 'data.forgejo.org/oci/ci:2'
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: https://data.forgejo.org/actions/cache@v5
+      - uses: https://data.forgejo.org/actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           key: rna-${{ env.RNA_VERSION }}
           path: ${{ env.RNA_WORKDIR }}

.forgejo/workflows/release-notes-assistant.yml

@@ -17,7 +17,7 @@ jobs:
     container:
       image: 'data.forgejo.org/oci/ci:2'
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: event
         run: |

.forgejo/workflows/testing-integration.yml

@@ -34,7 +34,7 @@ jobs:
       image: 'data.forgejo.org/oci/node:24-trixie'
       # options: --tmpfs /tmp:exec,noatime # Too much memory usage
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: install git 2.34.1 and git-lfs 3.0.2
         uses: ./.forgejo/workflows-composite/install-minimum-git-version
@@ -53,7 +53,7 @@ jobs:
       image: 'data.forgejo.org/oci/node:24-trixie'
       # options: --tmpfs /tmp:exec,noatime # Too much memory usage
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: install git 2.34.1 and git-lfs 3.0.2
         uses: ./.forgejo/workflows-composite/install-minimum-git-version
@@ -85,7 +85,7 @@ jobs:
           MARIADB_DATABASE: testgitea
         options: --tmpfs /var/lib/mysql:noatime
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: install dependencies
         run: apt-get update -qq && apt-get -q install -qq -y git-lfs

.forgejo/workflows/testing.yml

@@ -22,7 +22,7 @@ jobs:
           cat <<'EOF'
           ${{ toJSON(github) }}
           EOF
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       # DO NOT add checks here, but rather in the makefile
       - run: su forgejo -c './tools/cimake.sh pr-go'
@@ -36,9 +36,9 @@ jobs:
       image: 'data.forgejo.org/oci/node:24-trixie'
       # options: --tmpfs /tmp:exec,noatime # Too much memory usage
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: https://data.forgejo.org/actions/setup-node@v6
+      - uses: https://data.forgejo.org/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: .node-version
 
@@ -59,7 +59,7 @@ jobs:
           apt-get update -qq
           apt-get -q install -qq -y zstd
       - name: 'Cache frontend build for playwright testing'
-        uses: https://data.forgejo.org/actions/cache/save@v5
+        uses: https://data.forgejo.org/actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{github.workspace}}/public/assets
           key: frontend-build-${{ github.sha }}
@@ -86,7 +86,7 @@ jobs:
           MINIO_ROOT_USER: 123456
           MINIO_ROOT_PASSWORD: 12345678
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: test release-notes-assistant.sh
         run: |
@@ -108,12 +108,12 @@ jobs:
       image: 'data.forgejo.org/oci/playwright:latest'
       # options: --tmpfs /tmp:exec,noatime # Too much memory usage
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 20
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: 'Restore frontend build'
-        uses: https://data.forgejo.org/actions/cache/restore@v5
+        uses: https://data.forgejo.org/actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         id: cache-frontend
         with:
           path: ${{github.workspace}}/public/assets
@@ -129,7 +129,7 @@ jobs:
           echo "all=1" >> "$GITHUB_OUTPUT"
       - name: Get changed files
         id: changed-files
-        uses: https://data.forgejo.org/tj-actions/changed-files@v47
+        uses: https://data.forgejo.org/tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           separator: '\n'
       - run: |
@@ -177,7 +177,7 @@ jobs:
         env:
           ALLOW_EMPTY_PASSWORD: 'yes' # redis & valkey will immediately shutdown with no defined password unless overridden
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - run: |
           su forgejo -c 'make test-remote-cacher test-check'
@@ -205,7 +205,7 @@ jobs:
           MYSQL_EXTRA_FLAGS: --innodb-adaptive-flushing=OFF --innodb-buffer-pool-size=4G --innodb-log-buffer-size=128M --innodb-flush-log-at-trx-commit=0 --innodb-flush-log-at-timeout=30 --innodb-flush-method=nosync --innodb-fsync-threshold=1000000000 --disable-log-bin
         options: --tmpfs /bitnami/mysql/data:noatime
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: install dependencies
         run: apt-get update -qq && apt-get -q install -qq -y git-lfs
@@ -242,7 +242,7 @@ jobs:
           POSTGRESQL_EXTRA_FLAGS: -c full_page_writes=off
         options: --tmpfs /bitnami/postgresql
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: install dependencies
         run: apt-get update -qq && apt-get -q install -qq -y git-lfs
@@ -263,7 +263,7 @@ jobs:
       image: 'data.forgejo.org/oci/node:24-trixie'
       # options: --tmpfs /tmp:exec,noatime # Too much memory usage
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: install dependencies
         run: apt-get update -qq && apt-get -q install -qq -y git-lfs
@@ -290,7 +290,7 @@ jobs:
       image: 'data.forgejo.org/oci/node:24-trixie'
       # options: --tmpfs /tmp:exec,noatime # Too much memory usage
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.forgejo/workflows-composite/setup-env
       - run: su forgejo -c 'make deps-backend deps-tools'
       - run: su forgejo -c 'make security-check'
@@ -302,7 +302,7 @@ jobs:
       image: 'data.forgejo.org/oci/semgrep:latest'
     steps:
       - run: apk add nodejs # required for actions/checkout
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: self-check semgrep rules
         run: semgrep --test .semgrep/tests/ --config .semgrep/config/
       - name: semgrep ci