[setchy]

Summary

• Replace digest-update automerge for the exact gitify-app/renovate-config GitHub Actions package with pinDigests: false.
• Document the trusted validator's @main policy and exact zizmor workflow-path exception.
• Preserve unrelated settings, including :disableRateLimiting.

The validator tracks future changes merged into this repository. Consumers should use @main and, when using zizmor, configure ref-pin for the exact workflow path; the default hash-pin policy remains for other actions. The obsolete digest-automerge rule is removed.

Validation

• Passed: pnpm --package=renovate@44.182.2 dlx renovate-config-validator --strict --no-global default.json (CI-pinned Renovate version; local Node v24.22.2 and pnpm v12.16.1).
• The validator reported successful validation and exit code 0. Local native RE2 was unavailable because pnpm skipped dependency build scripts; Renovate used its documented RegExp fallback. No configuration validation warnings or errors were reported.
• Passed structural assertions: exactly one exception, matching only the github-actions manager and exact gitify-app/renovate-config package; all other config values unchanged.
• Inspected the complete diff: only default.json and README.md changed.

Source repository head: 39738c694a03c1862468f4376b59f0d32f6d028c.