From 212eff048c4419cd8f61152a4ac0bdd882d4587f Mon Sep 17 00:00:00 2001
From: William <236412244+william-u10d@users.noreply.github.com>
Date: Thu, 3 Sep 2026 07:16:34 -0700
Subject: [PATCH] chore(renovate): enable Renovate on this repo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Renovate has never run on github-workflows-public. A dry run against the
org's self-hosted Renovate confirms why:

  INFO: Repository started    (repository=Unstructured-IO/github-workflows-public)
  INFO: Repository is disabled - skipping
  "result": "disabled-no-config"

The GitHub App is installed and the clone succeeds ("cloned": true) — the
repo is skipped purely because it has no Renovate config file. The org's
global config (Unstructured-IO/infra, .github/config/renovate/config.js)
sets onboarding: false, and Renovate's requireConfig default is
"required", so a repo with no config is treated as disabled and no
onboarding PR is ever offered.

Consequence: the pinned action digests in .github/workflows/security.yaml
have gone unmaintained since the repo was created on 2026-08-14. The
SocketDev/socket-basics v3.0.0 -> v3.1.0 bump had to be made by hand in #2.

Adds a minimal renovate.json5 that extends config:recommended and
helpers:pinGitHubActionDigests, so every 'uses:' stays pinned to a full
commit SHA. No schedule restriction: this repo pins two actions, so
batching buys nothing while delaying security-scanner fixes.

reviewers is intentionally omitted — the infra team currently has only
'pull' on this repo, and GitHub requires push access to request a team
as a reviewer.
---
 renovate.json5 | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 renovate.json5

diff --git a/renovate.json5 b/renovate.json5
new file mode 100644
index 0000000..41ec751
--- /dev/null
+++ b/renovate.json5
@@ -0,0 +1,33 @@
+{
+  // Reason: this file is what makes Renovate run on this repo at all — it is
+  // not merely tuning. The org's self-hosted Renovate (Unstructured-IO/infra,
+  // .github/config/renovate/config.js) sets `onboarding: false`, and Renovate's
+  // `requireConfig` default is "required". Together those mean a repository
+  // with no Renovate config is skipped outright, logged as:
+  //
+  //   INFO: Repository is disabled - skipping
+  //   "result": "disabled-no-config"
+  //
+  // That is exactly what this repo was doing until now: Renovate cloned it on
+  // every run and then dropped it on the floor, so the pinned action digests in
+  // .github/workflows/security.yaml never got update PRs. Deleting this file
+  // silently re-disables the repo — it will not fail loudly. Keep it.
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+
+  extends: [
+    "config:recommended",
+    // Keep every `uses:` pinned to a full commit SHA with a version comment.
+    // This repo is consumed by public repos org-wide via a required-workflow
+    // ruleset, so an unpinned tag here is a supply-chain foothold everywhere.
+    "helpers:pinGitHubActionDigests",
+  ],
+
+  dependencyDashboard: true,
+  timezone: "America/Los_Angeles",
+
+  // Reason: no `schedule` restriction, deliberately diverging from the internal
+  // github-workflows repo's `schedule:earlyMondays`. That schedule exists there
+  // to batch a large, noisy dependency surface. This repo pins exactly two
+  // actions, so batching buys nothing while adding up to a week of latency to
+  // security-scanner fixes — the very thing this repo exists to distribute.
+}