Renovate auto-merges action-pin bumps inside the consumers' drift-governed workflow files (e.g. step-security/harden-runner v2.20.1 in checks.yml, 2026-08-05 14:40 UTC). From that moment every consumer differs from templates/typo3-extension again and the drift check goes red fleet-wide — until someone lifts the template to the same pin (#346) and re-runs the drift jobs. This race repeats on every renovate cycle that touches a governed file.
Two structural options, pick one: (a) renovate covers templates/ in this repo with priority/automerge, so the template moves first (or at least same-day) and consumers converge through their normal renovate PRs; (b) scripts/drift_compare.py learns pin-tolerance for uses: SHAs (compare action identity and comment tag, ignore the pinned SHA), so pin-only divergence is a notice, not a failure.
Renovate auto-merges action-pin bumps inside the consumers' drift-governed workflow files (e.g.
step-security/harden-runnerv2.20.1 inchecks.yml, 2026-08-05 14:40 UTC). From that moment every consumer differs fromtemplates/typo3-extensionagain and the drift check goes red fleet-wide — until someone lifts the template to the same pin (#346) and re-runs the drift jobs. This race repeats on every renovate cycle that touches a governed file.Two structural options, pick one: (a) renovate covers
templates/in this repo with priority/automerge, so the template moves first (or at least same-day) and consumers converge through their normal renovate PRs; (b)scripts/drift_compare.pylearns pin-tolerance foruses:SHAs (compare action identity and comment tag, ignore the pinned SHA), so pin-only divergence is a notice, not a failure.