From 9ab959dc23b937a6261bc54fdd1415ecc9ef25ac Mon Sep 17 00:00:00 2001
From: "will.porter" <will.porter@workos.com>
Date: Mon, 4 May 2026 18:33:43 +0000
Subject: [PATCH] chore: Add Renovate config for SHA-pinned GitHub Actions

Extends the shared workos/renovate-config preset, scoped to the
github-actions manager only. Enables:

- Automatic SHA-pinning of any newly-added GitHub Actions
- 7-day minimumReleaseAge on all GitHub Actions updates
- Grouped, automerged minor/patch/digest updates after CI
- Manual review for major version bumps

See https://github.com/workos/renovate-config for the preset.

Refs SECENG-299.
---
 renovate.json | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..3ccbd7b
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,5 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>workos/renovate-config"],
+  "enabledManagers": ["github-actions"]
+}