From dbc09a7f3da375a037693c82f3fea62c29166b3c Mon Sep 17 00:00:00 2001
From: "batch-changes-sourcegraph[bot]"
 <272382341+batch-changes-sourcegraph[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 23:57:38 +0000
Subject: [PATCH] chore(github-actions): enable Renovate SHA pinning

Co-authored-by: Sourcegraph <batch-changes@sourcegraph.com>
---
 .github/renovate.json5          | 24 ++++++++++++++++++++
 .github/workflows/renovate.yaml | 39 +++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 .github/renovate.json5
 create mode 100644 .github/workflows/renovate.yaml

diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..f5c5b1a
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,24 @@
+{
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "packageRules": [
+    {
+      "description": "Group all GitHub Actions updates into single PR",
+      "matchManagers": ["github-actions"],
+      "groupName": "GitHub Actions"
+    },
+    {
+      "description": "Disable GitHub Actions version updates - SHA pinning only",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major", "minor", "patch"],
+      "enabled": false
+    },
+    {
+      "description": "Disable container image updates - GitHub Actions pinning only",
+      "matchDatasources": ["docker"],
+      "enabled": false
+    }
+  ]
+}
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000..0c8e906
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,39 @@
+name: Renovate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: Run Renovate in dry-run mode
+        type: boolean
+        default: false
+      logLevel:
+        description: Renovate log level
+        type: choice
+        default: info
+        options:
+          - debug
+          - info
+          - warn
+          - error
+  schedule:
+    - cron: "17 8 * * *"
+  push:
+    branches: ["main"]
+    paths:
+      - .github/renovate.json5
+      - .github/renovate/**.json5
+      - .github/workflows/renovate.yaml
+
+concurrency:
+  group: run-renovate-bot
+  cancel-in-progress: true
+
+jobs:
+  renovate:
+    uses: coreweave/actions/.github/workflows/run-renovate.yml@workflows-v2
+    secrets: inherit
+    with:
+      runs-on: cw-dind-small-org
+      dry-run: ${{ inputs.dryRun }}
+      log-level: ${{ inputs.logLevel }}