feat(github-releases): getDigest()

[thepwagner]

Changes:

Adds an implementation of getDigest() for the github-releases datasource.

Like #10931 , this implementation relies on passing the current version and digest to the query site:

1. The current release is queried to identify the asset digested, called DigestAsset:
   1. In the first phase, <5KB assets attached to the release are download and parsed as checksum files (e.g. SHASUMS.txt, ${asset}.shasum). This uses string matching, so any digest algorithm is supported.
   2. If no checksum file is found, every asset attached to the release is fetched, hashed and compared. This is limited to sha256 and sha512 digests encoded in hexadecimal.
2. The DigestAsset is mapped on to the corresponding next releases, with a mapper for filenames that include the version.

Context:

I want to be able to pin digests of assets attached to GitHub releases, I've assembled a few projects of interest in (and tested this branch against) https://github.com/thepwagner/renovate-github-releases-digests .

• a project that releases individual .sha256sum files for each asset
• a project that releases a single sha256.txt assert
• a project that releases assets but not checksums

The method for mapping assets to digests is ported from updatedHash in a GitHub Action I use for maintaining dependencies; I'm hoping to archive that repo and use Renovate.

Supersedes #10931
Closes #7928

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[rarkins]

At a high level, this seems safe as it won't do anything unless there's a currentValue and currentDigest.

[viceice]

Some small things

[viceice]

Please add "**/test/**", to tsconfig.app.json exclude.

[renovate-release]

🎉 This PR is included in version 25.69.0 🎉

The release is available on:

• GitHub release
• 25.69.0

Your semantic-release bot 📦🚀