feat!: update to @bfra-me/renovate-action v5

.changeset/shiny-fishes-bake.md

@@ -0,0 +1,6 @@
+---
+"@bfra.me/.github": major
+---
+
+Update to @bfra-me/renovate-action v5
+

.github/renovate.json5

@@ -12,21 +12,22 @@
       allowedVersions: '<=3.12',
     },
     {
-      description: 'Enable SemVer digest pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
-      matchDatasources: ['github-tags'],
-      matchPackageNames: ['@bfra.me/**', 'bfra-me/**'],
+      description: 'Enable SemVer pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
+      matchPackageNames: ['@bfra.me/{/,}**', 'bfra-me/{/,}**'],
+      pinDigests: false,
       updatePinnedDependencies: false,
     },
     {
-      description: 'Enable SemVer digest pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
-      matchDatasources: ['github-tags'],
-      matchPackageNames: ['@bfra.me/**', 'bfra-me/**'],
+      description: 'Enable SemVer pinning of @bfra-me GitHub actions, reusable workflows, and Renovate config presets.',
+      matchPackageNames: ['@bfra.me/{/,}**', 'bfra-me/{/,}**'],
       matchUpdateTypes: ['major'],
+      pinDigests: false,
+      rangeStrategy: 'bump',
       updatePinnedDependencies: true,
     },
   ],
   postUpgradeTasks: {
-    commands: ['pnpm install --frozen-lockfile --ignore-scripts', 'pnpm run format'],
+    commands: ['pnpm run bootstrap', 'pnpm run format'],
     executionMode: 'branch',
   },
   prCreation: 'not-pending',

.github/settings.yml

@@ -11,8 +11,8 @@ branches:
   - name: main
     protection:
       required_status_checks:
-        strict: false
-        contexts: ['Lint', 'Release', 'Renovate']
+        strict: true
+        contexts: ['Create Renovate Changeset', 'Lint', 'Release', 'Renovate']
       enforce_admins: true
       required_pull_request_reviews: null
       restrictions: null

.github/workflows/main.yaml

@@ -56,7 +56,6 @@ jobs:
         with:
           app-id: ${{ secrets.APPLICATION_ID }}
           private-key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
       - name: Setup Git user
         run: |
           git config --global user.email '118100583+bfra-me[bot]@users.noreply.github.com'

.github/workflows/renovate-changeset.yaml

@@ -5,6 +5,9 @@ name: Create Renovate Changeset
   merge_group:
   pull_request_target:
 
+permissions:
+  contents: read
+
 jobs:
   create-changeset:
     name: Create Renovate Changeset

.github/workflows/renovate.yaml

@@ -101,7 +101,7 @@ jobs:
           dry_run: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
         if: >-
           ${{ !contains('["push", "workflow_run"]', github.event_name) || github.event.workflow_run.conclusion == 'success' || steps.filter.outputs.changes == 'true' }}
-        uses: bfra-me/renovate-action@v4
+        uses: bfra-me/renovate-action@v5
         with:
           autodiscover: ${{ env.autodiscover }}
           branch: ${{ (github.ref_name != github.event.repository.default_branch || env.dry_run == 'true') && ( github.head_ref || github.ref_name ) || '' }}

.github/workflows/update-repo-settings.yaml

@@ -49,7 +49,6 @@ jobs:
         with:
           app-id: ${{ secrets.APPLICATION_ID }}
           private-key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
 
       - env:
           GITHUB_TOKEN: ${{ steps.get-workflow-access-token.outputs.token }}