From fe4788d0c7cccb2761570f83952269bc15417b6d Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Thu, 6 Aug 2026 10:30:46 +0200 Subject: [PATCH] fix(renovate): manage action pins inside the workflow templates Consumers vendor templates/*/.github/workflows verbatim and the drift check compares byte-for-byte; when renovate bumped a pin in a consumer before the template moved, the whole fleet went red (harden-runner v2.20.1, 2026-08-05). With the templates managed here, the pin moves in the same renovate cycle and consumers converge through their own PRs. Fixes #353 Signed-off-by: Sebastian Mendel --- renovate.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 704047e..ae559ba 100644 --- a/renovate.json +++ b/renovate.json @@ -2,5 +2,11 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "local>netresearch/renovate-config" - ] + ], + "github-actions": { + "description": "Also manage action pins inside the workflow templates: consumers vendor these files verbatim and the drift check compares them byte-for-byte against templates/ \u2014 if renovate bumps a pin in a consumer before the template moves, the whole fleet goes red (issue #353). Managing the template here makes it move in the same cycle.", + "fileMatch": [ + "^templates/.+/\\.github/workflows/.+\\.ya?ml$" + ] + } }