⬆️👨‍💻 Pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/attest-build-provenance	action	pinDigest	-> 977bb37
actions/create-github-app-token	action	pinDigest	-> a8d6161
actions/download-artifact	action	pinDigest	-> 634f93c
munich-quantum-toolkit/workflows	action	pinDigest	-> d42342e
release-drafter/release-drafter	action	pinDigest	-> b1476f6

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[burgholzer]

@denialhaag just a general observation that also holds for other repositories: can we use these PRs (or any other PRs that update workflow digests) to explicitly add the full version to each of these dependencies (instead of the moving tags)? This creates much nicer update PRs and also enables automerge opportunities.

[denialhaag]

@denialhaag just a general observation that also holds for other repositories: can we use these PRs (or any other PRs that update workflow digests) to explicitly add the full version to each of these dependencies (instead of the moving tags)? This creates much nicer update PRs and also enables automerge opportunities.

Sure! I'll keep that in mind!

[denialhaag]

We are now using the pinGitHubActionDigestsToSemver helper. It looks like Renovate wants to create one PR per dependency to correct the comment. I'm merging this now and will let Renovate put the comments.