ci: run the v3 checks and let Renovate track the docs pins

.github/workflows/ci.yaml

@@ -4,7 +4,7 @@
 # check. PR-only: branch protection requires the check before merge, so a
 # post-merge re-run on main would be redundant (standard for config-only
 # repos). Hand-maintained (this repo is the sync source, not a sync target);
-# the pinned SHA is bumped by Renovate via the `# v2` comment.
+# the pinned SHA is bumped by Renovate via the `# v3` comment.
 name: CI
 
 on:
@@ -21,4 +21,4 @@ permissions:
 
 jobs:
   ci:
-    uses: cplieger/ci/.github/workflows/ci.yaml@c9c218d713f221dabb8504141b1ab4501d5ba7af # v2
+    uses: cplieger/ci/.github/workflows/ci.yaml@b5c28aa5341aa41fa0795f698bd44d0e26ff299a # v3

CONTRIBUTING.md

@@ -29,7 +29,7 @@ Changes only to these files never release:
 - Markdown files, PNG, JPEG, WebP, GIF and SVG files in the root `docs/` folder, the root `LICENSE` and the root `.github/` folder
 - the root `alerts/` folder and the root `compose.yaml`
 - the root `tests/` folder, any `testdata/` folder, and `_test.go`, `.test.ts` and `.spec.ts` files
-- any `package-lock.json`, `.punused-ignore` or knip configuration file
+- any `package-lock.json` or knip configuration file
 - the root `.editorconfig`, `.gitattributes`, `.gitignore` and `.dockerignore`
 
 ## Repositories whose default branch is `dev`

default.json

@@ -91,7 +91,7 @@
       "enabled": false
     },
     {
-      "description": "All four synced workflow destinations (ci/codeql/release/security, per cplieger/ci scripts/classify-repos.py) are OWNED by repo-sync: the templates carry the cplieger/ci digest pin, so every ci release already propagates to every consumer repo as auto-merging chore(sync) PRs with the new digest baked in. Disable Renovate on these destination files so sync is the single writer. Renovate used to race repo-sync on every ci release in these files: the sync PR usually landed first, Renovate autoclosed its now-redundant digest PR (GitHub permanently drops auto-merge arming when a PR closes), and the next release reopened the same PR unarmed \u2014 Renovate arms platform automerge only at PR creation, never on reopen \u2014 leaving permanently-green never-merging PRs cycling open/autoclosed (observed 2026-07-30..08-04 across 13 repos). Excluded: cplieger/ci (these filenames ARE the canonical reusable workflows there, where Renovate must keep updating pins) and cplieger/.github (hand-maintained ci.yaml; not a sync target since the repo is not releaseable). A future non-sync-target repo hand-maintaining one of these filenames needs its own exclusion here or its pins freeze, which is exactly what happened to cplieger/tool-catalog: a data repo with no releasable surface (no go.mod, jsr.json or Dockerfile), so classify-repos.py profiles it lang=none and no sync group writes its files. Its hand-maintained pins sat frozen at e0df4c8 from 2026-08-04, the day this rule landed, until 2026-08-12, 14 patch releases behind, while Renovate kept bumping every other dependency in that repo. Recompute this list whenever the sync manifest changes: the repos needing an exclusion are exactly those holding one of these filenames that no group in classify-repos.py's output writes. Measured 2026-08-12 across all 55 non-archived non-fork repos, that set is precisely the three named here (cplieger/ci's release.yaml self-pin, cplieger/.github's hand-maintained ci.yaml, and cplieger/tool-catalog's three).",
+      "description": "All four synced workflow destinations (ci/codeql/release/security, per cplieger/ci scripts/classify-repos.py) are OWNED by repo-sync: the templates carry the cplieger/ci digest pin, so every ci release already propagates to every consumer repo as auto-merging chore(sync) PRs with the new digest baked in. Disable Renovate on these destination files so sync is the single writer. Renovate used to race repo-sync on every ci release in these files: the sync PR usually landed first, Renovate autoclosed its now-redundant digest PR (GitHub permanently drops auto-merge arming when a PR closes), and the next release reopened the same PR unarmed \u2014 Renovate arms platform automerge only at PR creation, never on reopen \u2014 leaving permanently-green never-merging PRs cycling open/autoclosed (observed 2026-07-30..08-04 across 13 repos). Excluded: cplieger/ci (these filenames ARE the canonical reusable workflows there, where Renovate must keep updating pins) and cplieger/.github (hand-maintained ci.yaml; not a sync target since the repo is not releaseable). A future non-sync-target repo hand-maintaining one of these filenames needs its own exclusion here or its pins freeze, which is exactly what happened to cplieger/tool-catalog: a data repo with no releasable surface (no go.mod, jsr.json or Dockerfile), so classify-repos.py profiles it lang=none and no sync group writes its files. Its hand-maintained pins sat frozen at e0df4c8 from 2026-08-04, the day this rule landed, until 2026-08-12, 14 patch releases behind, while Renovate kept bumping every other dependency in that repo. Recompute this list whenever the sync manifest changes: the repos needing an exclusion are exactly those holding one of these filenames that no group in classify-repos.py's output writes. Measured 2026-10-09 across all 67 non-archived non-fork repos, that set is precisely the three named here (cplieger/ci's release.yaml self-pin, cplieger/.github's hand-maintained ci.yaml, and cplieger/docs's ci.yaml, codeql.yml and security.yml, another lang=none repo whose pins sat frozen from its first commit for want of this exclusion). cplieger/tool-catalog left the set when its publish.yaml put it in the artifact CI sync group, which now writes its ci.yaml, codeql.yml and security.yml.",
       "matchManagers": [
         "github-actions"
       ],
@@ -104,12 +104,12 @@
       "matchRepositories": [
         "!cplieger/ci",
         "!cplieger/.github",
-        "!cplieger/tool-catalog"
+        "!cplieger/docs"
       ],
       "enabled": false
     },
     {
-      "description": "Never digest-track cplieger/ci reusable workflows on a branch ref (a stray `# main`/`# master` instead of a release tag). A branch ref moves with every commit, so Renovate digest-chases HEAD and, with digest auto-merge on, loops forever (and fans out to every consumer via Sync). Reusable-workflow pins MUST track a release tag such as `# v2`.",
+      "description": "Never digest-track cplieger/ci reusable workflows on a branch ref (a stray `# main`/`# master` instead of a release tag). A branch ref moves with every commit, so Renovate digest-chases HEAD and, with digest auto-merge on, loops forever (and fans out to every consumer via Sync). Reusable-workflow pins MUST track a release tag such as `# v3`.",
       "matchManagers": [
         "github-actions"
       ],