PR #3 - Unstructured-IO/github-workflows-public

Companion to #2. That PR bumps Socket Basics by hand; this one is why it had to be done by hand.

The finding

Renovate has never run on this repo — zero PRs, zero renovate/* branches, no dependency dashboard since the repo was created on 2026-08-14. I confirmed the cause with a dry run of the org's self-hosted Renovate against this repo (run #33765279653):

INFO: Repository started        (repository=Unstructured-IO/github-workflows-public)
INFO: Repository is disabled - skipping
"result": "disabled-no-config"
"cloned": true

The GitHub App is installed and the clone succeeds. The repo is skipped purely because it has no Renovate config file:

the org's global config (Unstructured-IO/infra → .github/config/renovate/config.js) sets onboarding: false,
Renovate's requireConfig default is "required",
so a repo with no config is treated as disabled, and because onboarding is off, no onboarding PR is ever offered.

It fails silently and looks identical to "everything is up to date."

Why it matters here

This repo is the distribution point for Socket Basics scanning across every public repo in the org, enforced via the security/required-workflows-public ruleset. Its own pinned action digests going unmaintained is the failure mode you least want here. Two dependencies have been drifting unnoticed:

SocketDev/socket-basics — v3.0.0, superseded by v3.1.0 (fixed by hand in #2)
actions/checkout — pinned at de0fac2 (v6)

The change

A minimal renovate.json5:

config:recommended — baseline behaviour.
helpers:pinGitHubActionDigests — keeps every uses: pinned to a full commit SHA with a version comment. Matters more here than in a normal repo: an unpinned tag in this file becomes an unpinned tag in every public repo consuming the workflow.
dependencyDashboard: true — issues are enabled on this repo, so the dashboard will actually render. (Worth noting the internal github-workflows repo sets this too but has issues disabled, so its dashboard silently does nothing.)

Deliberate omissions, both explained in comments in the file:

No schedule. The internal repo uses schedule:earlyMondays to batch a large, noisy dependency surface. This repo pins two actions — batching buys nothing and adds up to a week of latency to security-scanner fixes.
No reviewers. The infra team currently has only pull on this repo, and GitHub requires push access to request a team as a reviewer. Grant infra write if you want auto-assignment, and I'll add it back.

The file carries a comment explaining that deleting it silently re-disables the repo, since an otherwise-thin config file looks like something you could clean up.

Verification

renovate-config-validator → INFO: Config validated successfully.
Cause established by dry run against the real self-hosted Renovate, not inferred.

Separate issue, not fixed here

The internal Unstructured-IO/github-workflows repo is not affected by the disabled-no-config problem — the same dry run shows Renovate correctly detects the Socket Basics update there:

"branchName": "renovate/socketdev-socket-basics-3.x",
"prTitle":    "chore(deps): update socketdev/socket-basics action to v3.1.0",
"result":     "branch-limit-reached"

But it is blocked by a saturated PR concurrency limit — prConcurrentLimit: 10 with exactly 10 open Renovate PRs, most stale since March/April. Nearly every pending update there reports branch-limit-reached. That backlog needs triaging (or the limit raising) in the internal repo; it's out of scope for this one.