From 1aece66c7f3fe212d9e7b087fe6e343870ee1c41 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sat, 3 Oct 2026 22:22:22 +0100
Subject: [PATCH 1/8] feat: validate workflows and actions, and prepare
 Renovate bumps

scripts/check-actions.sh runs actionlint and checks that every external
uses: reference resolves. The validate workflow runs it, then runs the
go-test and node-build actions and the node-pr workflow against small
fixtures, so a bump of an action they use is exercised before it merges.

renovate.json bumps the actions this repository uses. Minor and patch
bumps merge themselves once validate is green. Major bumps wait for a
person, because every consumer calls these actions at @main. The same
script runs as a Renovate post-upgrade task and marks a failing branch so
no PR opens.
---
 .github/workflows/validate.yaml          |  91 ++++++++++++++++++
 renovate.json                            |  37 ++++++++
 scripts/check-actions.sh                 | 115 +++++++++++++++++++++++
 testdata/selftest/go/add.go              |   5 +
 testdata/selftest/go/add_test.go         |   9 ++
 testdata/selftest/go/go.mod              |   3 +
 testdata/selftest/node/package-lock.json |  12 +++
 testdata/selftest/node/package.json      |  10 ++
 testdata/selftest/node/selftest.test.js  |   6 ++
 9 files changed, 288 insertions(+)
 create mode 100644 .github/workflows/validate.yaml
 create mode 100644 renovate.json
 create mode 100755 scripts/check-actions.sh
 create mode 100644 testdata/selftest/go/add.go
 create mode 100644 testdata/selftest/go/add_test.go
 create mode 100644 testdata/selftest/go/go.mod
 create mode 100644 testdata/selftest/node/package-lock.json
 create mode 100644 testdata/selftest/node/package.json
 create mode 100644 testdata/selftest/node/selftest.test.js

diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
new file mode 100644
index 0000000..fc70850
--- /dev/null
+++ b/.github/workflows/validate.yaml
@@ -0,0 +1,91 @@
+name: Validate
+
+# Checks that a change to the workflows or composite actions still works. Renovate
+# opens a PR for each action bump; this workflow is the gate those PRs must pass.
+# The aggregate job "validate" is the one required status check.
+
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+      - "scripts/**"
+      - "testdata/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: validate-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  static:
+    name: Static checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # actionlint, then every external `uses:` reference must resolve.
+      - name: Check workflows and action references
+        run: scripts/check-actions.sh --ci
+
+  selftest-go:
+    name: Self-test go-test action
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # The local path runs the action as it is on this branch, not at @main.
+      - name: Run the go-test action on the fixture module
+        uses: ./.github/actions/go-test
+        with:
+          working-directory: testdata/selftest/go
+
+  selftest-node-build:
+    name: Self-test node-build action
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Run the node-build action on the fixture project
+        uses: ./.github/actions/node-build
+        with:
+          build-script: cd testdata/selftest/node && npm ci && npm run build
+          cache-dependency-path: testdata/selftest/node/package-lock.json
+
+  selftest-node-pr:
+    name: Self-test node-pr workflow
+    uses: ./.github/workflows/node-pr.yaml
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      working-directory: testdata/selftest/node
+      require-tests: true
+
+  validate:
+    name: validate
+    if: always()
+    needs: [static, selftest-go, selftest-node-build, selftest-node-pr]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every check to pass
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          echo "results: $RESULTS"
+          for r in $RESULTS; do
+            if [ "$r" != success ]; then
+              echo "::error::a validation job finished as '$r'"
+              exit 1
+            fi
+          done
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..14c4a14
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "timezone": "Europe/London",
+  "enabledManagers": ["github-actions"],
+  "semanticCommits": "enabled",
+  "semanticCommitType": "chore",
+  "semanticCommitScope": "deps",
+  "dependencyDashboard": false,
+  "prConcurrentLimit": 0,
+  "prHourlyLimit": 0,
+  "minimumReleaseAge": "3 days",
+  "postUpgradeTasks": {
+    "commands": ["scripts/check-actions.sh --renovate"],
+    "fileFilters": [".validation-failed"],
+    "executionMode": "branch"
+  },
+  "packageRules": [
+    {
+      "description": "This repository's own composite actions are tracked at @main by design.",
+      "matchPackageNames": ["lukaszraczylo/shared-actions"],
+      "enabled": false
+    },
+    {
+      "description": "Minor and patch bumps merge on their own once the validate check is green.",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "Every consumer calls these actions at @main, so a major bump waits for a human.",
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "addLabels": ["major"]
+    }
+  ]
+}
diff --git a/scripts/check-actions.sh b/scripts/check-actions.sh
new file mode 100755
index 0000000..688411a
--- /dev/null
+++ b/scripts/check-actions.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# Static checks for the workflows and composite actions in this repository:
+#   1. actionlint (schema, expressions, and shell steps through shellcheck when present)
+#   2. every external `uses:` reference resolves to a real tag or branch
+#
+# Usage: scripts/check-actions.sh [--ci | --renovate]
+#   --ci        exit 1 when a check fails (default)
+#   --renovate  exit 0 and write .validation-failed when a check fails, so the
+#               Renovate runner deletes the branch before a PR can open
+#
+# Needs: bash, git, curl, tar, sha256sum or shasum. No other tools: actionlint is
+# downloaded at a pinned version and checked against a pinned SHA-256.
+set -u
+
+mode=--ci
+case "${1:-}" in
+  "" | --ci) mode=--ci ;;
+  --renovate) mode=--renovate ;;
+  *) echo "usage: $0 [--ci | --renovate]" >&2; exit 2 ;;
+esac
+
+ACTIONLINT_VERSION=1.7.12
+ACTIONLINT_SHA256_AMD64=8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+ACTIONLINT_SHA256_ARM64=325e971b6ba9bfa504672e29be93c24981eeb1c07576d730e9f7c8805afff0c6
+marker=.validation-failed
+
+cd "$(git rev-parse --show-toplevel)" || exit 2
+
+fail=0
+problem() {
+  echo "::error::$*" >&2
+  fail=1
+}
+
+sha256_of() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+}
+
+install_actionlint() {
+  local os arch want url tmp
+  case "$(uname -s)" in Linux) os=linux ;; Darwin) os=darwin ;; *) return 1 ;; esac
+  case "$(uname -m)" in
+    x86_64 | amd64) arch=amd64; want=$ACTIONLINT_SHA256_AMD64 ;;
+    aarch64 | arm64) arch=arm64; want=$ACTIONLINT_SHA256_ARM64 ;;
+    *) return 1 ;;
+  esac
+  # The pinned checksums are for the linux builds only.
+  [ "$os" = linux ] || return 1
+  tmp=$(mktemp -d)
+  url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_${os}_${arch}.tar.gz"
+  curl -fsSL --retry 3 -o "$tmp/a.tgz" "$url" || return 1
+  [ "$(sha256_of "$tmp/a.tgz")" = "$want" ] || { echo "actionlint checksum mismatch" >&2; return 1; }
+  tar -xzf "$tmp/a.tgz" -C "$tmp" actionlint || return 1
+  echo "$tmp/actionlint"
+}
+
+run_actionlint() {
+  local bin
+  if command -v actionlint >/dev/null 2>&1; then
+    bin=$(command -v actionlint)
+  else
+    bin=$(install_actionlint) || { problem "cannot install actionlint ${ACTIONLINT_VERSION}"; return; }
+  fi
+  # -shellcheck= disables the shellcheck pass when the binary is missing.
+  local opts=()
+  command -v shellcheck >/dev/null 2>&1 || opts+=(-shellcheck=)
+  # Info and style findings from shellcheck (for example SC2086 on intentional word
+  # splitting) do not fail the gate. Warnings and errors do. Composite actions are
+  # not linted by actionlint 1.7; workflows are.
+  opts+=(-ignore 'shellcheck reported issue.+SC[0-9]+:(info|style):')
+  if ! "$bin" "${opts[@]}" -color .github/workflows/*.y*ml; then
+    problem "actionlint reported problems"
+  fi
+}
+
+# Resolves every `uses: owner/repo[/path]@ref` that points outside this repository.
+check_refs() {
+  local files uses ref repo path checked=""
+  files=$(find .github -type f \( -name '*.yml' -o -name '*.yaml' \))
+  uses=$(grep -hoE '^[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*[^[:space:]#]+' $files | sed -E 's/^[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*//' | sort -u)
+  while IFS= read -r u; do
+    [ -n "$u" ] || continue
+    case "$u" in ./* | docker://*) continue ;; esac
+    repo=${u%%@*}
+    ref=${u#*@}
+    [ "$repo" != "$u" ] || { problem "no @ref in 'uses: $u'"; continue; }
+    # owner/repo/sub/path -> owner/repo
+    path=$(echo "$repo" | cut -d/ -f1,2)
+    # This repository's own composite actions are tracked at @main by design.
+    [ "$path" = lukaszraczylo/shared-actions ] && continue
+    case " $checked " in *" $path@$ref "*) continue ;; esac
+    checked="$checked $path@$ref"
+    if ! git ls-remote --exit-code "https://github.com/$path" "refs/tags/$ref" "refs/heads/$ref" >/dev/null 2>&1; then
+      # A full commit SHA is not listed by ls-remote; accept it when the repository answers at all.
+      if echo "$ref" | grep -qE '^[0-9a-f]{40}$' && git ls-remote --exit-code "https://github.com/$path" HEAD >/dev/null 2>&1; then
+        continue
+      fi
+      problem "'uses: $u' does not resolve: no tag or branch $ref in $path"
+    fi
+  done <<<"$uses"
+}
+
+rm -f "$marker"
+run_actionlint
+check_refs
+
+if [ "$fail" -ne 0 ]; then
+  if [ "$mode" = --renovate ]; then
+    echo "validation failed; writing $marker" >&2
+    printf 'actions validation failed\n' >"$marker"
+    exit 0
+  fi
+  exit 1
+fi
+echo "actions validation passed"
diff --git a/testdata/selftest/go/add.go b/testdata/selftest/go/add.go
new file mode 100644
index 0000000..dd709e9
--- /dev/null
+++ b/testdata/selftest/go/add.go
@@ -0,0 +1,5 @@
+// Package selftest is a fixture that the validate workflow runs the go-test action against.
+package selftest
+
+// Add returns the sum of a and b.
+func Add(a, b int) int { return a + b }
diff --git a/testdata/selftest/go/add_test.go b/testdata/selftest/go/add_test.go
new file mode 100644
index 0000000..fa38b71
--- /dev/null
+++ b/testdata/selftest/go/add_test.go
@@ -0,0 +1,9 @@
+package selftest
+
+import "testing"
+
+func TestAdd(t *testing.T) {
+	if got := Add(2, 3); got != 5 {
+		t.Fatalf("Add(2, 3) = %d, want 5", got)
+	}
+}
diff --git a/testdata/selftest/go/go.mod b/testdata/selftest/go/go.mod
new file mode 100644
index 0000000..ba3bdc8
--- /dev/null
+++ b/testdata/selftest/go/go.mod
@@ -0,0 +1,3 @@
+module example.com/selftest
+
+go 1.24
diff --git a/testdata/selftest/node/package-lock.json b/testdata/selftest/node/package-lock.json
new file mode 100644
index 0000000..3ec29e7
--- /dev/null
+++ b/testdata/selftest/node/package-lock.json
@@ -0,0 +1,12 @@
+{
+  "name": "selftest",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "selftest",
+      "version": "0.0.0"
+    }
+  }
+}
diff --git a/testdata/selftest/node/package.json b/testdata/selftest/node/package.json
new file mode 100644
index 0000000..8ed9b68
--- /dev/null
+++ b/testdata/selftest/node/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "selftest",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "lint": "node -e \"process.exit(0)\"",
+    "test": "node --test",
+    "build": "node -e \"console.log('built')\""
+  }
+}
diff --git a/testdata/selftest/node/selftest.test.js b/testdata/selftest/node/selftest.test.js
new file mode 100644
index 0000000..2ef81c9
--- /dev/null
+++ b/testdata/selftest/node/selftest.test.js
@@ -0,0 +1,6 @@
+const test = require('node:test');
+const assert = require('node:assert');
+
+test('addition', () => {
+  assert.strictEqual(2 + 3, 5);
+});

From 86ba34bab55ce7bd217fca825b87655399d26239 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sat, 3 Oct 2026 22:25:22 +0100
Subject: [PATCH 2/8] fix(validate): run on every pull request so the required
 check always reports

---
 .github/workflows/validate.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index fc70850..8e72911 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -4,12 +4,10 @@ name: Validate
 # opens a PR for each action bump; this workflow is the gate those PRs must pass.
 # The aggregate job "validate" is the one required status check.
 
+# No paths filter: "validate" is a required status check, and a required check
+# that never runs blocks a PR that touches only other files.
 on:
   pull_request:
-    paths:
-      - ".github/**"
-      - "scripts/**"
-      - "testdata/**"
   workflow_dispatch:
 
 permissions:

From b7c4914104c9e0255650b21134380a257af25764 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sat, 3 Oct 2026 22:28:58 +0100
Subject: [PATCH 3/8] fix(renovate): leave tool-version inputs and the
 GoReleaser version alone

---
 renovate.json | 46 +++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/renovate.json b/renovate.json
index 14c4a14..196b496 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "timezone": "Europe/London",
-  "enabledManagers": ["github-actions"],
+  "enabledManagers": [
+    "github-actions"
+  ],
   "semanticCommits": "enabled",
   "semanticCommitType": "chore",
   "semanticCommitScope": "deps",
@@ -10,28 +12,58 @@
   "prHourlyLimit": 0,
   "minimumReleaseAge": "3 days",
   "postUpgradeTasks": {
-    "commands": ["scripts/check-actions.sh --renovate"],
-    "fileFilters": [".validation-failed"],
+    "commands": [
+      "scripts/check-actions.sh --renovate"
+    ],
+    "fileFilters": [
+      ".validation-failed"
+    ],
     "executionMode": "branch"
   },
   "packageRules": [
     {
       "description": "This repository's own composite actions are tracked at @main by design.",
-      "matchPackageNames": ["lukaszraczylo/shared-actions"],
+      "matchPackageNames": [
+        "lukaszraczylo/shared-actions"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Tool versions in action inputs and defaults (Go, Node, GoReleaser) are policy, not pins. A bump would change what every consumer builds with.",
+      "matchDatasources": [
+        "golang-version",
+        "node-version"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "The GoReleaser version input is policy, not a pin.",
+      "matchDepNames": [
+        "goreleaser/goreleaser"
+      ],
       "enabled": false
     },
     {
       "description": "Minor and patch bumps merge on their own once the validate check is green.",
-      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "matchUpdateTypes": [
+        "minor",
+        "patch",
+        "digest",
+        "pin"
+      ],
       "automerge": true,
       "automergeType": "pr",
       "platformAutomerge": true
     },
     {
       "description": "Every consumer calls these actions at @main, so a major bump waits for a human.",
-      "matchUpdateTypes": ["major"],
+      "matchUpdateTypes": [
+        "major"
+      ],
       "automerge": false,
-      "addLabels": ["major"]
+      "addLabels": [
+        "major"
+      ]
     }
   ]
 }

From 8f20f32137314a1446a221a38f24745a04e8c75c Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sat, 3 Oct 2026 22:54:08 +0100
Subject: [PATCH 4/8] fix(renovate): do not post status checks (#3)

The GitHub App reads statuses but cannot write them. Renovate posts a
renovate/stability-days status on each branch for minimumReleaseAge. The
403 aborted the run as "repository changed" right after the first
branch was created. Turn the Renovate status checks off. minimumReleaseAge
still holds a release back.
---
 renovate.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 196b496..c74eac6 100644
--- a/renovate.json
+++ b/renovate.json
@@ -65,5 +65,11 @@
         "major"
       ]
     }
-  ]
+  ],
+  "statusCheckNames": {
+    "artifactError": null,
+    "configValidation": null,
+    "mergeConfidence": null,
+    "minimumReleaseAge": null
+  }
 }

From 852afeb5aa221f61c52a3a24d0f2e1d705ea54d1 Mon Sep 17 00:00:00 2001
From: "tozuo-home-cluster-eso[bot]"
 <287217661+tozuo-home-cluster-eso[bot]@users.noreply.github.com>
Date: Sat, 3 Oct 2026 23:00:46 +0100
Subject: [PATCH 5/8] chore(deps): update actions/setup-node action to v7 (#6)

Co-authored-by: tozuo-home-cluster-eso[bot] <287217661+tozuo-home-cluster-eso[bot]@users.noreply.github.com>
---
 .github/actions/node-build/action.yml      | 2 +-
 .github/workflows/go-release-cgo.yaml      | 2 +-
 .github/workflows/node-pr.yaml             | 2 +-
 .github/workflows/renovate-autoupdate.yaml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actions/node-build/action.yml b/.github/actions/node-build/action.yml
index 10ae185..2ecdf7a 100644
--- a/.github/actions/node-build/action.yml
+++ b/.github/actions/node-build/action.yml
@@ -18,7 +18,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v7
       with:
         node-version: ${{ inputs.node-version }}
         cache: "npm"
diff --git a/.github/workflows/go-release-cgo.yaml b/.github/workflows/go-release-cgo.yaml
index f8bf284..4ebe6ab 100644
--- a/.github/workflows/go-release-cgo.yaml
+++ b/.github/workflows/go-release-cgo.yaml
@@ -167,7 +167,7 @@ jobs:
                   fi
 
             - name: Setup Node.js
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@v7
               with:
                   node-version: ${{ inputs.node-version }}
                   cache: "npm"
diff --git a/.github/workflows/node-pr.yaml b/.github/workflows/node-pr.yaml
index 911ba9d..254e363 100644
--- a/.github/workflows/node-pr.yaml
+++ b/.github/workflows/node-pr.yaml
@@ -116,7 +116,7 @@ jobs:
           echo "pm=$pm" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
 
diff --git a/.github/workflows/renovate-autoupdate.yaml b/.github/workflows/renovate-autoupdate.yaml
index 0b59b21..2d624ea 100644
--- a/.github/workflows/renovate-autoupdate.yaml
+++ b/.github/workflows/renovate-autoupdate.yaml
@@ -363,7 +363,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
 

From 5cb199834503b044537a61bd4e91915ecde8b058 Mon Sep 17 00:00:00 2001
From: "tozuo-home-cluster-eso[bot]"
 <287217661+tozuo-home-cluster-eso[bot]@users.noreply.github.com>
Date: Sat, 3 Oct 2026 23:00:59 +0100
Subject: [PATCH 6/8] chore(deps): update actions/setup-go action to v7 (#5)

Co-authored-by: tozuo-home-cluster-eso[bot] <287217661+tozuo-home-cluster-eso[bot]@users.noreply.github.com>
---
 .github/actions/go-test/action.yml         |  2 +-
 .github/workflows/go-autoupdate.yaml       |  2 +-
 .github/workflows/go-pr.yaml               | 12 ++++++------
 .github/workflows/go-release-cgo.yaml      |  4 ++--
 .github/workflows/go-release.yaml          |  2 +-
 .github/workflows/renovate-autoupdate.yaml |  2 +-
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/actions/go-test/action.yml b/.github/actions/go-test/action.yml
index 407e762..8ddcf46 100644
--- a/.github/actions/go-test/action.yml
+++ b/.github/actions/go-test/action.yml
@@ -19,7 +19,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v7
       with:
         go-version: ${{ inputs.go-version }}
 
diff --git a/.github/workflows/go-autoupdate.yaml b/.github/workflows/go-autoupdate.yaml
index c30c828..5cf8ab8 100644
--- a/.github/workflows/go-autoupdate.yaml
+++ b/.github/workflows/go-autoupdate.yaml
@@ -51,7 +51,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           check-latest: true
diff --git a/.github/workflows/go-pr.yaml b/.github/workflows/go-pr.yaml
index c1cc8fe..4c0732c 100644
--- a/.github/workflows/go-pr.yaml
+++ b/.github/workflows/go-pr.yaml
@@ -92,7 +92,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           cache: true
@@ -136,7 +136,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           cache: true
@@ -199,7 +199,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           cache: true
@@ -240,7 +240,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           cache: true
@@ -277,7 +277,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           cache: true
@@ -317,7 +317,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           cache: true
diff --git a/.github/workflows/go-release-cgo.yaml b/.github/workflows/go-release-cgo.yaml
index 4ebe6ab..2ff038b 100644
--- a/.github/workflows/go-release-cgo.yaml
+++ b/.github/workflows/go-release-cgo.yaml
@@ -246,7 +246,7 @@ jobs:
                   fi
 
             - name: Setup Go
-              uses: actions/setup-go@v6
+              uses: actions/setup-go@v7
               with:
                   go-version: ${{ inputs.go-version }}
                   cache: true
@@ -322,7 +322,7 @@ jobs:
                   fi
 
             - name: Setup Go
-              uses: actions/setup-go@v6
+              uses: actions/setup-go@v7
               with:
                   go-version: ${{ inputs.go-version }}
 
diff --git a/.github/workflows/go-release.yaml b/.github/workflows/go-release.yaml
index b45404d..25a8596 100644
--- a/.github/workflows/go-release.yaml
+++ b/.github/workflows/go-release.yaml
@@ -184,7 +184,7 @@ jobs:
           fi
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
 
diff --git a/.github/workflows/renovate-autoupdate.yaml b/.github/workflows/renovate-autoupdate.yaml
index 2d624ea..406ca8f 100644
--- a/.github/workflows/renovate-autoupdate.yaml
+++ b/.github/workflows/renovate-autoupdate.yaml
@@ -328,7 +328,7 @@ jobs:
 
       - name: Setup Go
         if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go-version }}
           check-latest: true

From ffbec959bcc75ed8668f49ce25e7bc3897070da3 Mon Sep 17 00:00:00 2001
From: "tozuo-home-cluster-eso[bot]"
 <287217661+tozuo-home-cluster-eso[bot]@users.noreply.github.com>
Date: Sat, 3 Oct 2026 23:01:11 +0100
Subject: [PATCH 7/8] chore(deps): update actions/checkout action to v7 (#4)

Co-authored-by: tozuo-home-cluster-eso[bot] <287217661+tozuo-home-cluster-eso[bot]@users.noreply.github.com>
---
 .github/workflows/go-autoupdate.yaml       |  2 +-
 .github/workflows/go-pr.yaml               | 12 ++++++------
 .github/workflows/go-release-cgo.yaml      | 12 ++++++------
 .github/workflows/go-release.yaml          |  8 ++++----
 .github/workflows/node-pr.yaml             |  2 +-
 .github/workflows/renovate-autoupdate.yaml |  2 +-
 .github/workflows/validate.yaml            |  6 +++---
 7 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/go-autoupdate.yaml b/.github/workflows/go-autoupdate.yaml
index 5cf8ab8..300ebbe 100644
--- a/.github/workflows/go-autoupdate.yaml
+++ b/.github/workflows/go-autoupdate.yaml
@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
diff --git a/.github/workflows/go-pr.yaml b/.github/workflows/go-pr.yaml
index 4c0732c..767f289 100644
--- a/.github/workflows/go-pr.yaml
+++ b/.github/workflows/go-pr.yaml
@@ -78,7 +78,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
@@ -122,7 +122,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
@@ -185,7 +185,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
@@ -226,7 +226,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
@@ -264,7 +264,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           lfs: ${{ inputs.lfs }}
 
@@ -303,7 +303,7 @@ jobs:
       coverage: ${{ steps.coverage.outputs.coverage }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
diff --git a/.github/workflows/go-release-cgo.yaml b/.github/workflows/go-release-cgo.yaml
index 2ff038b..266f8f0 100644
--- a/.github/workflows/go-release-cgo.yaml
+++ b/.github/workflows/go-release-cgo.yaml
@@ -103,7 +103,7 @@ jobs:
         steps:
             - name: Checkout
               if: inputs.preflight
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   lfs: false
 
@@ -127,7 +127,7 @@ jobs:
         timeout-minutes: 30
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   lfs: ${{ inputs.lfs }}
@@ -154,7 +154,7 @@ jobs:
         timeout-minutes: 20
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   lfs: ${{ inputs.lfs }}
 
@@ -194,7 +194,7 @@ jobs:
         timeout-minutes: 10
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   lfs: ${{ inputs.lfs }}
@@ -229,7 +229,7 @@ jobs:
         timeout-minutes: 60
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   lfs: ${{ inputs.lfs }}
@@ -308,7 +308,7 @@ jobs:
         timeout-minutes: 60
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   lfs: ${{ inputs.lfs }}
diff --git a/.github/workflows/go-release.yaml b/.github/workflows/go-release.yaml
index 25a8596..abb1645 100644
--- a/.github/workflows/go-release.yaml
+++ b/.github/workflows/go-release.yaml
@@ -81,7 +81,7 @@ jobs:
     steps:
       - name: Checkout
         if: inputs.preflight
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           lfs: false
 
@@ -104,7 +104,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           lfs: ${{ inputs.lfs }}
 
@@ -131,7 +131,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
@@ -162,7 +162,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
diff --git a/.github/workflows/node-pr.yaml b/.github/workflows/node-pr.yaml
index 254e363..fe38c90 100644
--- a/.github/workflows/node-pr.yaml
+++ b/.github/workflows/node-pr.yaml
@@ -89,7 +89,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           lfs: ${{ inputs.lfs }}
 
diff --git a/.github/workflows/renovate-autoupdate.yaml b/.github/workflows/renovate-autoupdate.yaml
index 406ca8f..16dd523 100644
--- a/.github/workflows/renovate-autoupdate.yaml
+++ b/.github/workflows/renovate-autoupdate.yaml
@@ -263,7 +263,7 @@ jobs:
 
       # Not the triggering ref: a push or a manual run from another branch must still test the default branch.
       - name: Checkout the default branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.default.outputs.branch }}
           fetch-depth: 0
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 8e72911..25a21a8 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # actionlint, then every external `uses:` reference must resolve.
       - name: Check workflows and action references
@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # The local path runs the action as it is on this branch, not at @main.
       - name: Run the go-test action on the fixture module
@@ -51,7 +51,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run the node-build action on the fixture project
         uses: ./.github/actions/node-build

From c42cf115b8372e2417a2d210b65a9efe4c2d9b5c Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Sat, 3 Oct 2026 23:05:07 +0100
Subject: [PATCH 8/8] chore(autoupdate): author the update merge as Lukasz
 Raczylo (#7)

The Renovate autoupdate workflow merged each update branch with the
github-actions bot identity. It now uses lukasz@raczylo.com, the same
author as the cluster Renovate runner.
---
 .github/workflows/renovate-autoupdate.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/renovate-autoupdate.yaml b/.github/workflows/renovate-autoupdate.yaml
index 16dd523..d800829 100644
--- a/.github/workflows/renovate-autoupdate.yaml
+++ b/.github/workflows/renovate-autoupdate.yaml
@@ -272,8 +272,8 @@ jobs:
       - name: Merge the update branch locally
         id: merge
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "Lukasz Raczylo"
+          git config user.email "lukasz@raczylo.com"
           git fetch origin "$BRANCH"
           echo "head=$(git rev-parse FETCH_HEAD)" >> "$GITHUB_OUTPUT"
           echo "subject=$(git log -1 --format=%s FETCH_HEAD)" >> "$GITHUB_OUTPUT"