From eaaa2a3bc17679e6bc8116425c4ef0b48578aa65 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Oct 2026 08:35:35 +0000 Subject: [PATCH 1/2] Initial plan From f51cddf66351540692ffc098e42a1c5f7175a9b1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Oct 2026 08:42:29 +0000 Subject: [PATCH 2/2] fix: isolate Renovate updates to the allowlisted self-hosted runner Co-authored-by: lurtz <727209+lurtz@users.noreply.github.com> --- .github/renovate.json5 | 3 +++ .github/workflows/daily.yml | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index ab281ae2..63722ed3 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -12,6 +12,9 @@ // ******************************************************************************* { "$schema": "https://docs.renovatebot.com/renovate-schema.json", + // Only the self-hosted daily job has permission to run post-upgrade tasks. + // It overrides this setting with RENOVATE_FORCE to avoid competing runners. + "enabled": false, "extends": [ "config:base", ":dependencyDashboard", diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 41c6211c..af42343a 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -45,10 +45,11 @@ jobs: with: # Pull requests from forks do not have access to secrets token: ${{ secrets.RENOVATE_TOKEN }} - configurationFile: .github/renovate.json5 env: LOG_LEVEL: debug RENOVATE_REPOSITORIES: ${{ github.repository }} + # Enable only this runner; repository config disables other instances. + RENOVATE_FORCE: '{"enabled": true}' # Allow the post-upgrade tasks that refresh lockfile URLs and sha256 # digests and re-sync the generated tool table in tools/README.md # (allowedCommands is a global-only option, so it must be set here