From a4831d62101d79806280a98fc021e3ea0f2d8ca7 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:47:40 -0600
Subject: [PATCH] Extend Renovate coverage to workflow tool pins and the
 lockfile

Renovate only tracked direct dependencies, so tool versions pinned in
workflow env vars and transitive packages in uv.lock went stale.

- Annotate uv, actionlint, and markdownlint pins in the workflows so the
  customManagers:githubActionsVersions preset can update them
- Enable daily lock file maintenance to refresh transitive packages
- Enable OSV vulnerability alerts for locked packages

Amp-Thread-ID: https://ampcode.com/threads/T-01a1ca38-20a5-7436-a7ae-1f2bce712489
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/workflows/release.yml  |  1 +
 .github/workflows/validate.yml |  4 ++++
 renovate.json                  | 10 +++++++++-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a67d4bb..cf99d3f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,6 +63,7 @@ jobs:
     env:
       IMPORT_NAME: src_py_lib
       PYTHON_VERSION: "3.11"
+      # renovate: datasource=pypi depName=uv
       UV_VERSION: "0.11.7"
 
     steps:
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index e7ecbbd..76e5d22 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -94,6 +94,7 @@ jobs:
     if: needs.changes.outputs.github_actions == 'true'
     runs-on: ubuntu-24.04
     env:
+      # renovate: datasource=github-releases depName=rhysd/actionlint extractVersion=^v(?<version>.*)$
       ACTIONLINT_VERSION: "1.7.12"
 
     steps:
@@ -126,6 +127,7 @@ jobs:
     if: needs.changes.outputs.markdown == 'true'
     runs-on: ubuntu-24.04
     env:
+      # renovate: datasource=npm depName=markdownlint-cli2
       MARKDOWNLINT_CLI2_VERSION: "0.22.1"
 
     steps:
@@ -152,6 +154,7 @@ jobs:
     env:
       IMPORT_NAME: src_py_lib
       PYTHON_VERSION: "3.11"
+      # renovate: datasource=pypi depName=uv
       UV_VERSION: "0.11.7"
 
     steps:
@@ -215,6 +218,7 @@ jobs:
     env:
       IMPORT_NAME: src_py_lib
       PYTHON_VERSION: "3.11"
+      # renovate: datasource=pypi depName=uv
       UV_VERSION: "0.11.7"
 
     steps:
diff --git a/renovate.json b/renovate.json
index 10d01c0..585dc48 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,8 +1,16 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>sourcegraph/renovate-config"
+    "local>sourcegraph/renovate-config",
+    "customManagers:githubActionsVersions"
   ],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "before 4am"
+    ]
+  },
+  "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
       "matchPackageNames": [