ci: group action digest updates with non-major dependencies

Digest and pinDigest updates are not covered by the group:allNonMajor
preset (which only matches minor/patch), so SHA-pinned actions like
goreleaser-action produced standalone PRs. Since these actions are
pinned to floating major tags, a digest update is always within-major
and safe to group. Reuse the preset's groupName/groupSlug so they merge
into the same weekly grouped PR.

.github/renovate.json

@@ -6,20 +6,26 @@
     "schedule:weekly",
     ":semanticCommitTypeAll(chore)"
   ],
-  "mode": "full",
   "addLabels":["area: dependencies"],
+  "osvVulnerabilityAlerts": true,
+  "postUpdateOptions": ["gomodTidy"],
   "customManagers": [
     {
       "customType": "regex",
-      "fileMatch": ["^\\.github/workflows/.*\\.ya?ml$"],
+      "managerFilePatterns": ["/^\\.github/workflows/.*\\.ya?ml$/"],
       "matchStrings": [
-        "uses:\\s*golangci/golangci-lint-action@\\S+\\s+with:\\s+version:\\s*(?<currentValue>v[\\d.]+)"
+        "uses:\\s*golangci/golangci-lint-action@\\S+(?:\\s*#[^\\n]*)?\\s+with:\\s+version:\\s*(?<currentValue>v[\\d.]+)"
       ],
       "datasourceTemplate": "github-releases",
       "depNameTemplate": "golangci/golangci-lint"
     }
   ],
   "packageRules": [
+    {
+      "matchUpdateTypes": ["digest", "pinDigest"],
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-minor-patch"
+    },
     {
       "matchManagers": ["github-actions"],
       "addLabels": ["area: github actions"]

taskfile/ast/vars.go

@@ -98,6 +98,9 @@ func (vars *Vars) Values() iter.Seq[Var] {
 // ToCacheMap converts Vars to an unordered map containing only the static
 // variables
 func (vars *Vars) ToCacheMap() (m map[string]any) {
+	if vars == nil || vars.om == nil {
+		return nil
+	}
 	defer vars.mutex.RUnlock()
 	vars.mutex.RLock()
 	m = make(map[string]any, vars.Len())

taskfile/ast/vars_test.go

@@ -0,0 +1,55 @@
+package ast
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestVars_ToCacheMap(t *testing.T) {
+	t.Parallel()
+
+	t.Run("nil receiver returns nil", func(t *testing.T) {
+		t.Parallel()
+		var vars *Vars
+		assert.Nil(t, vars.ToCacheMap())
+	})
+
+	t.Run("empty vars returns empty map", func(t *testing.T) {
+		t.Parallel()
+		vars := NewVars()
+		m := vars.ToCacheMap()
+		assert.NotNil(t, m)
+		assert.Empty(t, m)
+	})
+
+	t.Run("static values are included", func(t *testing.T) {
+		t.Parallel()
+		vars := NewVars(
+			&VarElement{Key: "FOO", Value: Var{Value: "bar"}},
+			&VarElement{Key: "NUM", Value: Var{Value: 42}},
+		)
+		m := vars.ToCacheMap()
+		assert.Equal(t, map[string]any{"FOO": "bar", "NUM": 42}, m)
+	})
+
+	t.Run("live values take precedence over static values", func(t *testing.T) {
+		t.Parallel()
+		vars := NewVars(
+			&VarElement{Key: "FOO", Value: Var{Value: "bar", Live: "live-bar"}},
+		)
+		m := vars.ToCacheMap()
+		assert.Equal(t, map[string]any{"FOO": "live-bar"}, m)
+	})
+
+	t.Run("dynamic variables are excluded", func(t *testing.T) {
+		t.Parallel()
+		sh := "echo hello"
+		vars := NewVars(
+			&VarElement{Key: "STATIC", Value: Var{Value: "ok"}},
+			&VarElement{Key: "DYNAMIC", Value: Var{Sh: &sh}},
+		)
+		m := vars.ToCacheMap()
+		assert.Equal(t, map[string]any{"STATIC": "ok"}, m)
+	})
+}