Renovate still opens updates for GitHub Actions at commit level

[oscard0m]

Seems like the noise is still there even though we have removed helpers:pinGitHubActionDigests

Example: octokit/auth-unauthenticated.js#161

Should we run a script to move GitHub actions back to a tag? i.e. actions/setup-node@v3

[gr2m]

Thanks to @oscard0m's https://github.com/oscard0m/octoherd-script-update-action-version-in-workflows, I've updated all uses of actions/checkout, actions/setup-node and github/codeql-action/* to the respective latest v*.

Let me know if there are any left. When node is setup, and you have GITHUB_TOKEN env defined, you can run the script like this (set --actionName, --actionVersion, and --workflow accordingly. --workflow is optional, it defaults to * in which case all workflow files are checked)

npx octoherd-script-update-action-version-in-workflows@latest \
        --actionName github/codeql-action/analyze \
        --actionVersion v2 \
        --workflow codeql.yml \
        -T $GITHUB_TOKEN \
        -R "octokit/*"