SRE-800: Auto-bump hashintel/.github workflow pins

[claude]

Requested via Slack thread

Closes SRE-800

Before

After a merge to hashintel/.github, every consuming repo's "🚀 Dependency Updates" dashboard holds the reusable-workflow digest bump (branch deps/gha/hashintel-.github-digest, dep hashintel/.github) under Pending Approval until someone ticks the checkbox in each repo — as happened with #76 on 2026-07-11, when zero bump PRs appeared until the boxes were ticked manually. The global dependencyDashboardApproval: true in this shared preset gates them, and the github-actions rule's "schedule": ["before 2am on saturday"] plus the global minimumReleaseAge: "14 days" would delay them further even once approved.

After

Renovate opens the bump PRs in all consuming repos on its next 2-hourly run with no approval step, and the existing global automerge: true (+ automergeSchedule) takes them in once CI is green.

How

Adds a packageRule to renovate-config.json — the shared preset every hashintel repo extends via github>hashintel/.github:renovate-config, so this applies org-wide:

{
  "description": "Automatically bump the org's own reusable-workflow pins without dashboard approval",
  "matchManagers": ["github-actions"],
  "matchPackageNames": ["hashintel/.github"],
  "matchUpdateTypes": ["digest"],
  "dependencyDashboardApproval": false,
  "minimumReleaseAge": "0 days",
  "schedule": ["at any time"]
}

• Placement: immediately after the existing github-actions rule — Renovate merges packageRules in order, so the later rule overrides that rule's Saturday-only schedule for these pins while inheriting its commitMessageTopic, branch prefix, and assignees.
• Scope: matchUpdateTypes: ["digest"] limits the override to the SHA-pin bumps of our own reusable workflows; ordinary third-party action updates keep the existing approval + Saturday schedule.
• Schedule: "at any time" so bumps go out on the next Renovate run after a merge here rather than waiting for Saturday; minimumReleaseAge: "0 days" explicitly defeats the global 14-day cooldown.

npx renovate-config-validator (renovate 43.243.2, the version pinned in this repo): "Config validated successfully against 1 file(s)".

[cursor]

PR Summary

Low Risk
Renovate-only preset change for first-party workflow digest pins; no runtime or application code affected.

Overview
Adds a Renovate packageRule to the shared org preset (renovate-config.json) so digest updates for hashintel/.github reusable workflow pins no longer sit behind the dependency dashboard approval flow.

For those pins only, the rule sets dependencyDashboardApproval: false, minimumReleaseAge: "0 days", and schedule: ["at any time"], so bumps can open on the next Renovate run instead of waiting on manual dashboard ticks, the global 14-day cooldown, or the Saturday-only github-actions schedule. Third-party GitHub Action updates keep the existing approval and Saturday schedule.

^{Reviewed by Cursor Bugbot for commit be0c48d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Updates the shared Renovate preset (github>hashintel/.github:renovate-config) to automatically publish digest bumps for the org’s own reusable workflow pins (hashintel/.github) without requiring Dependency Dashboard approval, so consuming repositories receive these updates immediately and can automerge after CI passes.

Changes:

• Adds a targeted packageRules override for github-actions deps where matchPackageNames: ["hashintel/.github"] and matchUpdateTypes: ["digest"].
• Disables dashboard gating for those updates (dependencyDashboardApproval: false) and removes delays (minimumReleaseAge: "0 days", schedule: ["at any time"]).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.