I've been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It's similar to Dependabot in that it keeps your dependencies up to date. If I had to compare them in one sentence, I'd say Renovate is less integrated in the GitHub ecosystem, but handles more ecosystems and, more importantly, is extensible. My current company is a happy Renovate user, and I already started to use it in some repositories.
I have previously written about Agentic Workflows. As a reminder, you first create the workflow in Markdown with a very loose syntax. Then, you "compile" it to generate a GitHub Workflow-compliant YAML file, suffixed with .lock.yml.
In this post, I want to describe the problem when combining the two, how I tried to fix it, and the correct solution.
The core problem
Renovate is very eager to please. By default, it scans all ecosystems used for dependencies: build.gradle.kts, pom.xml, pyproject.toml, Dockerfile, GitHub workflows, etc. Most "manual" GitHub workflows use GitHub actions, which are versioned dependencies.
