From 04411e7ca6893da1580fea678162e3611d38ce77 Mon Sep 17 00:00:00 2001
From: Juanpe Araque <juanpedro.araque@datadoghq.com>
Date: Wed, 29 Apr 2026 11:47:56 +0200
Subject: [PATCH 1/2] Track pinned Python deps in workflows via Renovate

Add a custom regex manager that picks up 'name==X.Y[.Z]' patterns in
.github/workflows/*.yml and proposes Renovate PRs to bump them. Groups
all workflow Python deps under one weekly batch with a dedicated label.
PRs require human review (no auto-merge).
---
 renovate.json | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index bce7e6fdd6995..e03895c322783 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,20 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "enabledManagers": [
-    "github-actions"
+    "github-actions",
+    "custom.regex"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "^\\.github/workflows/[^/]+\\.ya?ml$"
+      ],
+      "matchStrings": [
+        "(?<depName>[a-zA-Z][a-zA-Z0-9._-]*)==(?<currentValue>[0-9]+(?:\\.[0-9]+){1,2})"
+      ],
+      "datasourceTemplate": "pypi"
+    }
   ],
   "packageRules": [
     {
@@ -49,6 +62,20 @@
         "renovate/actions",
         "qa/skip-qa"
       ]
+    },
+    {
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "groupName": "workflow python deps",
+      "schedule": [
+        "before 6am on Monday"
+      ],
+      "labels": [
+        "renovate/workflow-deps",
+        "qa/skip-qa"
+      ],
+      "minimumReleaseAge": "7 days"
     }
   ]
 }

From 464d4eb7e82d1aaae9ea4f1bb4f67cf96bca8bb8 Mon Sep 17 00:00:00 2001
From: Juanpe Araque <juanpedro.araque@datadoghq.com>
Date: Wed, 29 Apr 2026 12:02:42 +0200
Subject: [PATCH 2/2] Cover env-var pins via Renovate annotations and add CI
 validator

Codex review on PR #23511 noted that the regex manager only matches
literal name==X.Y.Z pins, missing two of the four pinned workflow
deps (pyoxidizer via the PYOXIDIZER_VERSION env var, and the ddev
fallback default in release-dispatch.yml).

- Annotate PYOXIDIZER_VERSION with '# renovate: datasource=pypi
  depName=pyoxidizer'.
- Refactor release-dispatch.yml to extract the default ddev version
  into a DEFAULT_DDEV_VERSION env var with the same annotation. The
  resolved install command is functionally equivalent.
- Extend renovate.json's customManager with a second matchString
  pattern that picks up annotated 'KEY: "X.Y[.Z]"' env values.
- Add validate-renovate-config.yml so CI fails if renovate.json ever
  becomes invalid.
---
 .github/workflows/build-ddev.yml              |  1 +
 .github/workflows/release-dispatch.yml        |  7 ++++++-
 .../workflows/validate-renovate-config.yml    | 20 +++++++++++++++++++
 renovate.json                                 |  3 ++-
 4 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/validate-renovate-config.yml

diff --git a/.github/workflows/build-ddev.yml b/.github/workflows/build-ddev.yml
index bc2786b1b1423..439ec45b079c3 100644
--- a/.github/workflows/build-ddev.yml
+++ b/.github/workflows/build-ddev.yml
@@ -29,6 +29,7 @@ defaults:
 env:
   APP_NAME: ddev
   PYTHON_VERSION: "3.13"
+  # renovate: datasource=pypi depName=pyoxidizer
   PYOXIDIZER_VERSION: "0.24.0"
 
 jobs:
diff --git a/.github/workflows/release-dispatch.yml b/.github/workflows/release-dispatch.yml
index b6e1c71054fb7..9e2775500b8d8 100644
--- a/.github/workflows/release-dispatch.yml
+++ b/.github/workflows/release-dispatch.yml
@@ -40,6 +40,11 @@ permissions:
   id-token: write
   contents: write # ddev needs to push tags
 
+env:
+  # Default ddev version when callers don't pass `ddev-version`. Tracked by Renovate.
+  # renovate: datasource=pypi depName=ddev
+  DEFAULT_DDEV_VERSION: "14.3.2"
+
 jobs:
   prepare:
     name: Tag releases and build dispatch batches
@@ -55,7 +60,7 @@ jobs:
           fetch-depth: 0 # ddev needs full tag history
 
       - name: Install ddev
-        run: pip install "ddev${{ inputs.ddev-version && format('=={0}', inputs.ddev-version) || '==14.3.2' }}"
+        run: pip install "ddev==${{ inputs.ddev-version || env.DEFAULT_DDEV_VERSION }}"
 
       - name: Configure ddev
         env:
diff --git a/.github/workflows/validate-renovate-config.yml b/.github/workflows/validate-renovate-config.yml
new file mode 100644
index 0000000000000..2547c19d09d57
--- /dev/null
+++ b/.github/workflows/validate-renovate-config.yml
@@ -0,0 +1,20 @@
+name: Validate Renovate config
+
+on:
+  pull_request:
+    paths:
+      - 'renovate.json'
+  push:
+    branches:
+      - master
+    paths:
+      - 'renovate.json'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Validate Renovate config
+        run: npx --yes --package renovate renovate-config-validator --strict renovate.json
diff --git a/renovate.json b/renovate.json
index e03895c322783..10dd7ebcde91f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -11,7 +11,8 @@
         "^\\.github/workflows/[^/]+\\.ya?ml$"
       ],
       "matchStrings": [
-        "(?<depName>[a-zA-Z][a-zA-Z0-9._-]*)==(?<currentValue>[0-9]+(?:\\.[0-9]+){1,2})"
+        "(?<depName>[a-zA-Z][a-zA-Z0-9._-]*)==(?<currentValue>[0-9]+(?:\\.[0-9]+){1,2})",
+        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[a-zA-Z][a-zA-Z0-9._-]*)\\s+[A-Z][A-Z0-9_]*: \"(?<currentValue>[0-9]+(?:\\.[0-9]+){1,2})\""
       ],
       "datasourceTemplate": "pypi"
     }