From 390e4d34f74f8c59bcad45d7faa1209ed1b027e2 Mon Sep 17 00:00:00 2001
From: Tony Germano <tony@germano.name>
Date: Sun, 1 Nov 2026 11:10:07 -0500
Subject: [PATCH] Validate renovate.json in CI

Add a workflow that runs renovate-config-validator from the official
Renovate image on pushes and pull requests to main that change
renovate.json or the workflow itself. Otherwise a mistake in the
config only shows up the next time Renovate runs on the repository.

The image is referenced as a docker:// step, pinned by tag and
digest, so Renovate's github-actions manager keeps it current like
the other pinned actions.

The validator runs with --strict --no-global. Without --no-global,
a file named on the command line is validated as global self-hosted
configuration, which accepts options a repository config may not
set: a renovate.json containing allowedCommands passes without the
flag and fails with it.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Tony Germano <tony@germano.name>
---
 .github/workflows/renovate-config.yaml | 47 ++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/renovate-config.yaml

diff --git a/.github/workflows/renovate-config.yaml b/.github/workflows/renovate-config.yaml
new file mode 100644
index 000000000..38f3ceb60
--- /dev/null
+++ b/.github/workflows/renovate-config.yaml
@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Tony Germano <tony@germano.name>
+
+name: Validate Renovate config
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - renovate.json
+      - .github/workflows/renovate-config.yaml
+  pull_request:
+    branches:
+      - main
+    paths:
+      - renovate.json
+      - .github/workflows/renovate-config.yaml
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # A docker:// reference rather than a docker run command so that
+      # Renovate's github-actions manager keeps the image current.
+      #
+      # --no-global is required because renovate.json is a repository
+      # config. When given file names, renovate-config-validator treats
+      # them as global configuration for a self-hosted Renovate instance
+      # unless --no-global is passed. Global configuration may set options
+      # that a repository config is not allowed to, such as
+      # allowedCommands, so without the flag those options would pass
+      # validation. --no-global validates the file as a repository config,
+      # which rejects them.
+      #
+      # --strict also fails on warnings and on options that need migration.
+      - name: Validate renovate.json
+        uses: docker://ghcr.io/renovatebot/renovate:44.199.0@sha256:76e0fb8c982004f8f9a6dd041a777f9c8aee6b4b852da862a1217c5ec550e6d9
+        with:
+          entrypoint: renovate-config-validator
+          args: --strict --no-global renovate.json