ci(renovate): pin default @bfra-me/renovate-config config preset

.changeset/sour-glasses-return.md

@@ -0,0 +1,6 @@
+---
+"@bfra.me/.github": patch
+---
+
+Pin default `@bfra-me/renovate-config` config preset with actions and workflows
+

.github/renovate.json5

@@ -1,25 +1,20 @@
 {
   $schema: 'https://docs.renovatebot.com/renovate-schema.json',
   extends: [
-    'github>bfra-me/renovate-config#v3.7.7',
+    'github>bfra-me/renovate-config#v3',
     'github>bfra-me/renovate-config:internal.json5#v3.7.7',
   ],
   packageRules: [
     {
-      description: 'Disable digest pinning for @bfra-me GitHub actions and reusable workflows.',
-      matchDepTypes: ['action'],
+      description: 'Enable SemVer digest pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
+      matchDatasources: ['github-tags'],
       matchPackageNames: ['@bfra.me/**', 'bfra-me/**'],
-      pinDigests: false,
       rangeStrategy: 'replace',
       updatePinnedDependencies: false,
     },
   ],
   postUpgradeTasks: {
-    commands: [
-      'npm install -g [email protected]',
-      'pnpm install --frozen-lockfile --ignore-scripts',
-      'pnpm run format',
-    ],
+    commands: ['pnpm install --frozen-lockfile --ignore-scripts', 'pnpm run format'],
     executionMode: 'branch',
   },
 }

package.json

@@ -24,7 +24,6 @@
   "devDependencies": {
     "@actions/exec": "1.1.1",
     "@bfra.me/prettier-config": "0.4.0",
-    "@changesets/changelog-github": "0.5.0",
     "@changesets/cli": "2.27.7",
     "@swisspost/design-system-changelog-github": "1.0.2",
     "@types/node": "20.14.10",