Improve Renovate configuration, add pre-commit hooks to validate Renovate configuration (#16330)

* Improve Renovate configuration

* Validate Renovate and GitHub workflow configuration

* Update .github/renovate.json5

Author: AlexWaygood

.github/renovate.json5

@@ -2,9 +2,15 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "dependencyDashboard": true,
   "suppressNotifications": ["prEditedNotification"],
-  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigestsToSemver",
+    "replacements:all",
+    "abandonments:recommended"
+  ],
+  "configMigration": true,
   "labels": ["bot: dependencies"],
-  "rebaseLabel": ["bot: rebase"],
+  "rebaseLabel": "bot: rebase",
   "semanticCommits": "disabled",
   "separateMajorMinor": false,
   "prHourlyLimit": 10,
@@ -15,7 +21,13 @@
   "pre-commit": {
     "enabled": true
   },
+  "minimumReleaseAge": "7 days",
   "packageRules": [
+    {
+      // Pin versions already in use without waiting for the upgrade cooldown.
+      "matchUpdateTypes": ["pinDigest"],
+      "minimumReleaseAge": null
+    },
     {
       groupName: "GitHub Actions",
       matchManagers: ["github-actions"],

.pre-commit-config.yaml

@@ -10,6 +10,12 @@ repos:
       - id: mixed-line-ending
         args: [--fix=lf]
       - id: check-case-conflict
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 12e63946db2c5cfcc9030fac21c3883ba88c6ed8 # frozen: 0.38.0
+    hooks:
+      - id: check-github-workflows
+      - id: check-renovate
+        additional_dependencies: ["json5==0.15.0"]
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # The Ruff version must match requirements-tests.txt.
     rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56 # frozen: v0.15.20