[setchy]

Two changes: stop the bump churn, and let the validator find the config itself.

1. Gate the Renovate bump behind dashboard approval

renovate.json tracks the exact Renovate version pinned in the validator workflow. Upstream ships several releases a day, so the pin is always behind, and every bump merge moves main — which raises an auto-merged digest PR in each of the 4 consumers that pin this workflow by SHA (gitify, electron-menubar, website, gnome).

"packageRules": [
  {
    "matchDepNames": ["renovate"],
    "matchDatasources": ["npm"],
    "dependencyDashboardApproval": true,
    "schedule": ["at any time"]
  }
]

• Updates queue under Awaiting Approval on Dependency Dashboard Dependency Dashboard #1; a PR is only opened once ticked.
• schedule is not a mergeable option (Renovate only concatenates mergeable arrays in lib/config/utils.ts), so ["at any time"] replaces the preset's schedule:weekly and an approved bump opens immediately.
• Pin bumped 44.167.7 → 44.181.6, so the pending renovate/renovate-44.x branch has nothing left to update. The pin stays exact and reproducible.

2. Let the validator discover the config files

Replaces the ls/compgen detection, hand-maintained filename list, realpath/ABS word-splitting, scratch working directory and # shellcheck disable=SC2086 suppressions (one malformed → SC1072/SC1073, actionlint red on main):

# Renovate discovers renovate.json / .renovaterc* / package.json by
# itself. Preset files (default.json) are not discovered, so name them.
if [ -f default.json ]; then
  set -- ./*.json
fi
npx ... renovate-config-validator --strict --no-global "$@"

• Verified auto-discovery for renovate.json, .renovaterc.json and a renovate key in package.json. default.json is not in upstream's configFilePatterns, so preset repos still name their files.
• --no-global fixes a real bug: passing CLI args makes the validator treat those files as self-hosted global config (INFO: Validating ./default.json as global config). They are now validated as repo config, which is correct for a preset.
• The unused files input is dropped — no consumer in either org passes it.
• The scratch-directory workaround is gone: npx --package … installs to the npm cache, so the repo's package.json engines/packageManager cannot block it (verified with an incompatible engines.node and engine-strict=true).
• Behaviour change: a repo with no Renovate config now passes with WARN: No files to perform configuration validation against instead of failing.

Validation

actionlint clean, renovate-config-validator --strict --no-global passes on 44.181.6, and the step was exercised against this preset repo, a consumer renovate.json, .renovaterc.json, package.json + renovate, and an empty directory. Same changes as setchy/renovate-config#27.