[neilime]

Summary

The Buildx version and BuildKit image are pinned in action input defaults, which Dependabot does not update. Run Renovate through renovatebot/github-action to maintain both defaults automatically.

• Add a SHA-pinned workflow that runs every Friday at 04:23 UTC and supports manual runs. Authenticate with the existing CI bot GitHub App credentials and scope the installation token to this repository.
• Limit Renovate to the annotated Buildx and BuildKit defaults, group their updates, and require a minimum release age of seven days. Dependabot continues to manage the other dependencies.
• Replace the two FIXME comments with Renovate annotations and document the workflow, credentials, and configuration validation command.

Closes #831
Closes #832

Validation

• actionlint .github/workflows/__renovate.yml passed.
• Renovate's strict repository configuration validator passed.
• Renovate's local extraction identified exactly docker/buildx and moby/buildkit.
• Renovate's replacement engine successfully applied two successive synthetic version updates to each dependency, preserving the BuildKit image name and all other action fields.
• Prettier, Biome, and git diff --check passed for the changed files.

Runtime requirements

The workflow uses CI_BOT_APP_CLIENT_ID and CI_BOT_APP_PRIVATE_KEY, also referenced by the existing CI workflows. The bot needs read access to checks and write access to contents, issues, pull requests, and commit statuses.

Live workflow execution has not been tested. Organization-level credential availability could not be verified because the current GitHub CLI credentials lack the required organization administration access.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
RENOVATE	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter