fix: renovate for github runners

[AlexHardAtWork]

What

Enables Renovate for Github Runners.

Part of #odd-internal/28.

Why

Runners need updates.

Testing

Not tested.

Notes for reviewers

...

Checklist

• Tests added/updated
• No breaking changes (or upgrade path documented above)
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

Summary by CodeRabbit

• Chores
  • Updated dependency management configuration to enable automatic tracking and updates of GitHub Actions runner images in workflow files.

[coderabbitai]

Warning

Rate limit exceeded

@AlexHardAtWork has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 53 minutes and 10 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fd05ca45-72ac-4f65-ae70-e97fe69af9db

📥 Commits

Reviewing files that changed from the base of the PR and between 4369271 and 7554d56.

📒 Files selected for processing (1)

• renovate.json

📝 Walkthrough

Walkthrough

Renovate configuration is extended with a custom manager rule targeting GitHub Actions workflow files to automatically detect and manage runner image version updates extracted from runs-on patterns.

Changes

GitHub Actions Runner Version Management

Layer / File(s)	Summary
Renovate custom manager for GitHub Actions runners renovate.json	A customManagers regex rule is added to parse GitHub Actions workflow files for runs-on: <depName>-<currentValue> patterns and configure Renovate to fetch and suggest updates from the github-runners datasource with docker versioning.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• opendefensecloud/apiserver-kit#78: Updates runs-on runner values in GitHub Actions workflows from arc-scale-set to ubuntu-24.04, which becomes the target values managed by this new Renovate rule.

Poem

🐰 A rabbit configured the flow,
To watch those runners high and low,
No manual updates anymore—
Renovate keeps the versions pure! 🎯

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: renovate for github runners' is concise and directly describes the main change to the renovate.json configuration for GitHub Actions runners.
Description check	✅ Passed	The description follows the template structure with all required sections (What, Why, Testing, Checklist), though some sections lack detail (Testing states 'Not tested', Notes for reviewers contains only '...').
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/28-renovate-github-runners

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@renovate.json`:
- Line 68: The regex in renovate.json that matches runner versions (the pattern
capturing currentValue currently limited to digits and dots) fails for values
like "latest"; update that pattern so the currentValue capture accepts
alphabetic text, hyphens, dots and numeric versions (e.g., allow
alphanumeric/hyphen/dot or specifically the token "latest") so runners like
ubuntu-latest, windows-latest and numeric versions are all matched.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8619cac6-b2cc-47d8-be10-2807e317a209

📥 Commits

Reviewing files that changed from the base of the PR and between 1ef40f7 and 4369271.

📒 Files selected for processing (1)

• renovate.json

[yocaba]

Since apiserver-kit has already been migrated to shared renovate configs, we need to make the change in https://github.com/opendefensecloud/renovate-config/blob/main/default.json.

[AlexHardAtWork]

Blocked by opendefensecloud/renovate-config#3