chore(renovate): adopt config:best-practices and pin GitHub Action digests

[skevetter]

Switches devsy's Renovate config from config:recommended to config:best-practices plus helpers:pinGitHubActionDigests, so GitHub Actions are pinned to commit SHAs. Keeps the existing devsy-specific allowedVersions pins.

Validated with renovate-config-validator and a local renovate --platform=local dry run confirming Action digest pinning resolves correctly.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	54eaf3c
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a3e56efb7794c0008afe679

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	54eaf3c
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a3e56ef82019d00086bbd99

[coderabbitai]

Warning

Review limit reached

@skevetter, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 37 minutes and 9 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 86fa118d-cac2-4e6a-9185-d129ce66695a

📥 Commits

Reviewing files that changed from the base of the PR and between 29c8559 and 54eaf3c.

📒 Files selected for processing (9)

• .github/workflows/act.yml
• .github/workflows/commit.yml
• .github/workflows/desktop-ci.yml
• .github/workflows/devcontainer.yml
• .github/workflows/labeler.yml
• .github/workflows/pr-ci.yml
• .github/workflows/release.yml
• .github/workflows/workflow-approval.yml
• renovate.json

📝 Walkthrough

Walkthrough

The Renovate preset now defines repository-wide defaults and update-specific rules for automerge behavior and pull request priority.

Changes

Renovate preset configuration

Layer / File(s)	Summary
Global preset defaults renovate/default.json	Adds preset metadata and baseline Renovate settings, including best-practices extension, GitHub Action digest pinning, pre-commit support, dependency dashboard disabling, PR concurrency limits, platform automerge, and Go module tidy post-update handling.
Automerge and priority rules renovate/default.json	Adds packageRules for major, minor, and patch updates, and for the github-actions, pre-commit, and gomod managers, setting automerge behavior and prPriority values.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: a Renovate preset adopting best-practices config and pinning GitHub Action digests.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}