Exclude .github/workflows/release.yml from Renovate to prevent automated dependency updates from interfering with sensitive release processes.
Add the pinGitHubActionDigests helper to improve CI security by using immutable commit SHA digests instead of mutable tags.