From 8cede6af09b1ec40607c80a591e07c355b4d0318 Mon Sep 17 00:00:00 2001
From: Robin Bowes <robin@yo61.com>
Date: Fri, 16 Oct 2026 08:35:37 +0100
Subject: [PATCH] ci: let Renovate update PREK_VERSION

Move the Lint job's prek version into an annotated PREK_VERSION env, as
in yo61/global and python-template, and add a renovate.json5 so the
self-hosted Renovate in yo61/infrastructure keeps it. Renovate runs only
custom.regex here: Dependabot keeps action SHAs, npm, docker and
pre-commit hooks, so each pin has one owner.

Refs GLB-32

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml |  5 ++++-
 renovate.json5           | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 renovate.json5

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e3439fa..229ee007 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,11 @@ jobs:
         with:
           persist-credentials: false
       - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        env:
+          # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
+          PREK_VERSION: 0.5.5
         with:
-          prek-version: 0.5.5
+          prek-version: ${{ env.PREK_VERSION }}
 
   sanity-checks:
     permissions:
diff --git a/renovate.json5 b/renovate.json5
new file mode 100644
index 00000000..69674c65
--- /dev/null
+++ b/renovate.json5
@@ -0,0 +1,32 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+
+  // Dependabot keeps the action SHAs, npm, docker and pre-commit hooks (.github/dependabot.yml).
+  // Renovate owns only the annotated *_VERSION values CI installs, so only custom.regex runs.
+  extends: ["config:recommended", "customManagers:githubActionsVersions"],
+  enabledManagers: ["custom.regex"],
+
+  // Policy shared by every repository Renovate updates; keep the copies alike.
+  semanticCommits: "enabled",
+  dependencyDashboard: true,
+  minimumReleaseAge: "7 days",
+  minimumReleaseAgeBehaviour: "timestamp-optional",
+  prHourlyLimit: 0,
+  prConcurrentLimit: 10,
+  osvVulnerabilityAlerts: true,
+  vulnerabilityAlerts: {
+    semanticCommitType: "fix",
+    labels: ["security"],
+  },
+
+  packageRules: [
+    {
+      matchUpdateTypes: ["major"],
+      minimumReleaseAge: "14 days",
+    },
+    {
+      matchFileNames: [".github/workflows/**"],
+      semanticCommitScope: "ci",
+    },
+  ],
+}