datasource/github-release-attachments: use asset digest field to avoid downloading release assets

[RahulGautamSingh]

Description

The github-release-attachments datasource resolves a release asset's digest by, in order:

1. _findDigestFile: download small assets (size < 5 KB) and parse them as checksum manifests (lib/modules/datasource/github-release-attachments/index.ts:54)
2. findAssetWithDigest: sort all assets by size and download+hash each one until a match is found

Since June 2025, the GitHub REST API exposes a digest field (sha256:...) on each release asset, but Renovate never reads it .. and GithubRestAsset doesn't even declare the field.

Impact

For releases where no asset is under the 5 KB threshold and the checksums file exceeds 5 KB, Renovate falls through to strategy 2 and downloads every asset to hash it up to ~1.2 GB per lookup, repeated every 24h when the cache TTL expires. Observed on seaweedfs/seaweedfs, go-acme/lego, and smallstep/cli, all of which expose digest on every asset.

Proposed fix

Add digest?: string to GithubRestAsset and introduce a new primary strategy in findDigestAsset that matches against the API-provided digest before falling back to the two existing download-based strategies (kept for pre-June-2025 releases that lack the field).

Links

• Discussion: Use GitHub's release asset `digest` field in the `github-release-attachments` datasource #45242