Renovate is updating GHA commit hashes to the latest version on the main branch, as opposed to latest release version

This is a problem. We only want stable versions of actions, unless we specifically request otherwise.

Perhaps there's a setting somewhere to adjust this?

Inspect the repository's Renovate configuration and GitHub Actions workflow references to find how action versions are selected. Confirm whether Renovate can target stable release versions rather than the latest main-branch commit, and verify that future updates use stable versions by default.

Written by the indexing model from the issue text.