[neilime]

Dependabot does not update uses: docker://… references, leaving the Ratchet and reusable Super-Linter images without automated updates. Add a scheduled and manually dispatched Renovate workflow that updates only those Docker action tags and digests.

Dependabot remains the primary updater for Dockerfiles, GitHub Actions, npm, and devcontainers; its configuration is unchanged. Renovate disables all dependencies by default and enables only Docker action references. Super-Linter's Dockerfile and workflow updates arrive in separate PRs and should be reviewed together to keep the images aligned.

The workflow uses the existing CI bot app, scoped to this repository, with explicit permissions including Workflows write access. It runs on Fridays at 04:23 UTC and opens PRs for review without automerging. A seven-day release delay applies when timestamps are available; missing GHCR timestamps do not block updates.

Validation

• Renovate 44.169.0 strict repository configuration validation passed.
• Renovate's native extraction and package rules enabled exactly the two Docker action references and excluded 85 other dependencies, plus synthetic container, service, and action-input image cases.
• Four tag-and-digest and digest-only update simulations passed using Renovate's native updater.
• Actionlint, Biome, focused make lint, and git diff --check passed. Actionlint and the extraction/update checks were repeated after rebasing onto the latest main.
• The live GitHub workflow has not been dispatched; the CI bot installation must grant the documented permissions.

Fixes #521.
Refs #608.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
RENOVATE	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter
Super-linter revision: 2da136927bd4a73596db63044b504547c62cb854
Super-linter version: 9.0.0