Update templated files

.github/mergify.yml

@@ -1,34 +1,11 @@
 pull_request_rules:
-  - name: automatic merge dependabot
-    conditions:
-      - author=dependabot[bot]
-    actions:
-      merge:
-        method: rebase
-        rebase_fallback: squash
-
-  - name: approve dependabot
-    conditions:
-      - author=dependabot[bot]
-    actions:
-      review:
-        type: APPROVE
-
   - name: automatic merge repomanager
     conditions:
       - author=the-repository-manager[bot]
     actions:
       merge:
         method: rebase
         rebase_fallback: squash
-
-  - name: approve repomanager
-    conditions:
-      - author=the-repository-manager[bot]
-    actions:
-      review:
-        message: auto approve repomanager
-
   - name: assign to owner
     conditions:
       - check-failure>1

.github/renovate.json5

@@ -0,0 +1,13 @@
+{
+  "extends": [
+    "config:base",
+    "workarounds:typesNodeVersioning"
+  ],
+  "automerge": true,
+  "platformAutomerge": true,
+  "lockFileMaintenance": { "enabled": true },
+  "pinDigests": true,
+  "dependencyDashboard": false,
+  "rollbackPrs": true,
+  "assignees": ["chrisns"]
+ }

.github/workflows/security.yml

@@ -10,24 +10,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/[email protected]
+      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2.4.0
       with:
         fetch-depth: 2
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@5f532563584d71fdef14ee64d17bafb34f751ce5 # renovate: tag=v1.0.26
       continue-on-error: true
       id: initcodeql
     - name: Autobuild
       if: steps.initcodeql.outcome == 'success'
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@5f532563584d71fdef14ee64d17bafb34f751ce5 # renovate: tag=v1.0.26
     - name: Perform CodeQL Analysis
       if: steps.initcodeql.outcome == 'success'
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@5f532563584d71fdef14ee64d17bafb34f751ce5 # renovate: tag=v1.0.26
 
   ShiftLeft:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/[email protected]
+    - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2.4.0
     - name: Perform ShiftLeft Scan
       uses: ShiftLeftSecurity/scan-action@master
       env:
@@ -37,6 +37,6 @@ jobs:
       with:
         output: reports
     - name: Upload report
-      uses: github/codeql-action/upload-sarif@v1
+      uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # renovate: tag=v1.0.26
       with:
         sarif_file: reports