ci: group action digest updates with non-major dependencies

Digest and pinDigest updates are not covered by the group:allNonMajor
preset (which only matches minor/patch), so SHA-pinned actions like
goreleaser-action produced standalone PRs. Since these actions are
pinned to floating major tags, a digest update is always within-major
and safe to group. Reuse the preset's groupName/groupSlug so they merge
into the same weekly grouped PR.

.github/renovate.json

@@ -6,20 +6,26 @@
     "schedule:weekly",
     ":semanticCommitTypeAll(chore)"
   ],
-  "mode": "full",
   "addLabels":["area: dependencies"],
+  "osvVulnerabilityAlerts": true,
+  "postUpdateOptions": ["gomodTidy"],
   "customManagers": [
     {
       "customType": "regex",
-      "fileMatch": ["^\\.github/workflows/.*\\.ya?ml$"],
+      "managerFilePatterns": ["/^\\.github/workflows/.*\\.ya?ml$/"],
       "matchStrings": [
-        "uses:\\s*golangci/golangci-lint-action@\\S+\\s+with:\\s+version:\\s*(?<currentValue>v[\\d.]+)"
+        "uses:\\s*golangci/golangci-lint-action@\\S+(?:\\s*#[^\\n]*)?\\s+with:\\s+version:\\s*(?<currentValue>v[\\d.]+)"
       ],
       "datasourceTemplate": "github-releases",
       "depNameTemplate": "golangci/golangci-lint"
     }
   ],
   "packageRules": [
+    {
+      "matchUpdateTypes": ["digest", "pinDigest"],
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-minor-patch"
+    },
     {
       "matchManagers": ["github-actions"],
       "addLabels": ["area: github actions"]