From a0911519d12ec8bc7d2ab9dfcf7ae10a40844230 Mon Sep 17 00:00:00 2001
From: Piotr Zaniewski <piotrzan@gmail.com>
Date: Tue, 20 Oct 2026 18:15:49 +0200
Subject: [PATCH] chore(ci): restore rolling internal action tags

Internal SHA pins freeze shared action fixes until each caller is edited.
Restore verified published tags and exempt loft-sh actions from Renovate
digest pinning so callers receive rolling internal releases.

Scope the new Renovate config to GitHub Actions so other dependency
ecosystems keep their current behavior.

Closes DEVOPS-1683
---
 .github/workflows/validate-renovate.yaml |  2 +-
 renovate.json                            | 28 ++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 renovate.json

diff --git a/.github/workflows/validate-renovate.yaml b/.github/workflows/validate-renovate.yaml
index c620e9b1..e2951d40 100644
--- a/.github/workflows/validate-renovate.yaml
+++ b/.github/workflows/validate-renovate.yaml
@@ -16,4 +16,4 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: loft-sh/github-actions/.github/workflows/validate-renovate.yaml@b52efbd927586ea78282073f79d2423e552c9f62 # validate-renovate/v1
+    uses: loft-sh/github-actions/.github/workflows/validate-renovate.yaml@validate-renovate/v1 # validate-renovate/v1
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..ae0d0ca6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,28 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "enabledManagers": [
+    "github-actions"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "Keep internal loft-sh actions on rolling version tags",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchPackageNames": [
+        "loft-sh/**"
+      ],
+      "pinDigests": false
+    }
+  ]
+}