From fd518ed6c2916e4238902fb9773cf37924858d81 Mon Sep 17 00:00:00 2001
From: Adam Setch <adam.setch@outlook.com>
Date: Thu, 8 Oct 2026 06:59:22 -0700
Subject: [PATCH] ci(renovate): add reusable Renovate config validator workflow

Adds a reusable workflow that validates Renovate preset files by explicit filename with --strict, and can be called by consumer repositories to validate their own config.

Part of the harden-org-renovate-preset change.
---
 .../workflows/renovate-config-validator.yml   | 69 +++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 .github/workflows/renovate-config-validator.yml

diff --git a/.github/workflows/renovate-config-validator.yml b/.github/workflows/renovate-config-validator.yml
new file mode 100644
index 0000000..e28a03a
--- /dev/null
+++ b/.github/workflows/renovate-config-validator.yml
@@ -0,0 +1,69 @@
+name: Renovate Config Validation
+
+on:
+  # Reusable: consumers call this to validate their own Renovate config.
+  workflow_call:
+    inputs:
+      files:
+        description: Space-separated Renovate config/preset files to validate. Empty auto-detects.
+        required: false
+        type: string
+        default: ""
+  # Self-triggered: validate the preset files in this repository.
+  push:
+    branches:
+      - main
+    paths:
+      - "*.json"
+      - ".github/workflows/renovate-config-validator.yml"
+  pull_request:
+    paths:
+      - "*.json"
+      - ".github/workflows/renovate-config-validator.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Renovate config
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Determine files to validate
+        id: files
+        env:
+          INPUT_FILES: ${{ inputs.files }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_FILES}" ]; then
+            # Explicit list supplied by the caller.
+            FILES="${INPUT_FILES}"
+          elif compgen -G "renovate.json*" >/dev/null || compgen -G ".renovaterc*" >/dev/null; then
+            # A repository's own Renovate config.
+            FILES="$(ls renovate.json renovate.json5 renovate.jsonc \
+              .renovaterc .renovaterc.json .renovaterc.jsonc .renovaterc.json5 2>/dev/null || true)"
+          else
+            # Preset repository: every root JSON file is a preset.
+            FILES="$(ls ./*.json 2>/dev/null || true)"
+          fi
+          if [ -z "${FILES}" ]; then
+            echo "No Renovate config or preset files found to validate." >&2
+            exit 1
+          fi
+          echo "Validating: ${FILES}"
+          echo "files=${FILES}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate Renovate config
+        run: >-
+          npx --yes --ignore-scripts --package renovate --
+          renovate-config-validator --strict ${{ steps.files.outputs.files }}