Pin astral-sh/ruff-action to a specific commit

[correctmost]

PR Description:

The GitHub docs recommend pinning third-party actions to specific commits for security hardening purposes:

https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

A recent security issue:

• https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

[svartkanin]

Interesting, so this means that we need to keep track of releases and manually update the hash moving forward. So if there was vulnerabilities discovered in previous versions we need to be aware of that and potentially update the hash.
Generally this seems kinda counter intuitive, the idea of using "latest" IMHO is to not having to monitor things constantly and relay on the most up-to-date version with fixes. Now the recommendation is to move backwards and pin things...

[correctmost]

It seems like Renovate can handle the bumping of actions with specific commit hashes: https://docs.renovatebot.com/presets-helpers/#helperspingithubactiondigests

I will look into adding ruff-action to renovate.json.

[svartkanin]

So would the updates be pushed for every new tag release hash?

[correctmost]

So would the updates be pushed for every new tag release hash?

Yep. With my latest commit, Renovate bot should now submit PRs for actions releases using a hash instead of a tag (because tags are mutable).

This change will affect all actions, including ones from GitHub. If things get too noisy, we can add some additional config to schedule the updates less frequently.

[svartkanin]

Okay lets try it out