From 49a2a6bf48c8b018fbdf5151fec30eb3b35ef306 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 21 Jul 2026 09:27:36 +0000
Subject: [PATCH] ci: let Renovate manage GitHub Actions in .yml.jinja
 workflows

Renovate's built-in github-actions manager only matches *.yml/*.yaml
files and skips rust/.github/workflows/dogfood.yml.jinja, so its pinned
actions (actions/checkout, cachix/install-nix-action) drifted behind the
rest of the repo. The .jinja file is not valid YAML, so extending the
github-actions manager's file matching would not help either.

Add a regex customManager to the root config that matches the
"uses: <owner>/<repo>@<sha> # <version>" pattern in *.yml.jinja workflow
files, using the github-tags datasource with digest pinning so Renovate
updates both the SHA and the version comment. The file pattern excludes
plain *.yml workflows, so it does not overlap the built-in manager.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018VZKNtriTdAXdRkpapkEJU
---
 .github/renovate.json5 | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index d79fc9d..48d4441 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -13,6 +13,17 @@
     }
   },
   "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/(^|/)\\.github/workflows/[^/]+\\.ya?ml\\.jinja$/"
+      ],
+      "matchStrings": [
+        "uses:\\s+(?<depName>[\\w.-]+/[\\w.-]+)@(?<currentDigest>[a-f0-9]{40})\\s+#\\s+(?<currentValue>v?[\\d.]+)"
+      ],
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "docker"
+    },
     {
       "customType": "regex",
       "managerFilePatterns": [