[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
opendefensecloud/dev-kit	major	v2.1.0 → v3.1.0	v3.1.1

---

Release Notes

opendefensecloud/dev-kit

v3.1.0

Compare Source

Changes

• chore: update PR template to reduce manual editing @​yocaba (#​52)
• feat: relock go-overlay on Renovate's Go version PR @​AlexHardAtWork (#​56)
• chore: run the fmt and lint hooks in dev-kit's own shell @​AlexHardAtWork (#​57)

v3.0.4

Compare Source

Changes

• fix: reusable workflow permissions @​AlexHardAtWork (#​54)
• feat: add needs-update issue label to repo settings setup @​yocaba (#​55)

v3.0.3

Compare Source

Changes

• fix(issues-add-to-project): request no token permissions @​cbrgm (#​53)

v3.0.2

Compare Source

Changes

• fix(flake-closure-diff): pass the head profile as an absolute path @​AlexHardAtWork (#​51)

v3.0.1

Compare Source

Changes

• chore(deps): update determinatesystems/nix-installer-action action to v23 @​renovate[bot] (#​49)
• chore(deps): update actions/checkout action to v7 @​renovate[bot] (#​48)
• ci: manage dev-kit's own dependencies with Renovate @​AlexHardAtWork (#​46)
• feat: add check-dev-kit-pins and a flake.lock closure diff @​AlexHardAtWork (#​44)

v3.0.0

Compare Source

Migrating from v2

v3.0.0 is breaking: the governance workflows move into dev-kit as reusable workflows, and make repo-settings no longer installs update-action-pins.yml. In each consuming repository, in order:

1. Bump all three dev-kit pins to v3.0.0 — DEV_KIT_VERSION in the Makefile, the flake.nix input, and setup-nix in the workflows. With renovate-config they arrive together in one dev-kit PR; when it changes flake.nix, commit nix flake update dev-kit on the branch (its PR body says so).
2. Replace the local copies of update-action-pins, conventional-commits, osv-scanner, issues-add-labels and issues-add-to-project with the stubs from the README's "Governance workflows" section. scorecard stays a standalone workflow.
3. Update REPO_STATUS_CHECKS to the names reusable workflows report, <stub job> / <called job> (e.g. update-action-pins / Check action pins, osv-scanner / scan-pr / osv-scan), then have a repo admin run make repo-settings. Do both in the same change, or the old names stay required and never report.
4. Add .common.mk-configs to .gitignore — it records which shared configs common.mk fetched.

Optional:

• Shared formatting is opt-in: run make fmt-all once, commit, then set DEV_KIT_FORMATTING := on before -include common.mk.
• renovate-dev-kit-lock commits the relocked flake.lock to Renovate's dev-kit PR. It needs the dev-kit-bot app and the DEV_KIT_BOT_APP_* org secrets on the repository (currently solution-arsenal only).
• Pin runs-on in your own workflows to ubuntu-24.04, as dev-kit's reusable workflows now do.

No stub triggers on merge_group; see the README before enabling a merge queue.

Changes

• feat: add check-go-version and report unavailable goVersion @​AlexHardAtWork (#​33)
• feat!: make governance workflows reusable @​dermorz (#​41)
• feat: moved common linting configs and setups to dev-kit @​rebEllieous (#​34)
• fix: stop auto-approving pushes onto Renovate branches @​yocaba (#​36)
• feat: check headers regarding copyright and license @​yocaba (#​35)

v2.2.0

Compare Source

Changes

• ci: add missing workflow permissions and widen the action-pin check @​AlexHardAtWork (#​32)
• feat: add setup-nix composite action @​AlexHardAtWork (#​30)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.