Use public Renovate approval action directly

.github/workflows/auto-approve-bot-prs.yml

@@ -12,33 +12,15 @@ concurrency:
 
 jobs:
   approve:
-    if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' && vars.RENOVATE_GH_APP_CLIENT_ID != ''
+    if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != ''
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - name: Create read-only token for the shared approval action
-        id: policy-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }}
-          private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: renovate-config
-          permission-contents: read
-      - name: Checkout the pinned shared approval action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: StackVista/renovate-config
-          ref: 45d01defd5070a9c05f0b3bf9b28995487bd8262
-          token: ${{ steps.policy-token.outputs.token }}
-          path: renovate-config
-          sparse-checkout: .github/actions/auto-approve-renovate
-          persist-credentials: false
       - name: Approve verified Renovate PRs
-        uses: ./renovate-config/.github/actions/auto-approve-renovate # zizmor: ignore[self-repository]
+        uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@45d01defd5070a9c05f0b3bf9b28995487bd8262
         with:
           app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }}

.github/workflows/renovate.yml

@@ -29,9 +29,7 @@ jobs:
           client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: |
-            stackstate-backup-cli
-            renovate-config
+          repositories: stackstate-backup-cli
           permission-contents: write
           permission-pull-requests: write
           permission-issues: write

README.md

@@ -468,14 +468,13 @@ The library group includes direct and indirect modules.
 Other module minors, module majors, and Go release-line migrations require manual review.
 Dependency updates reach published binaries through the existing tag release process.
 
-This public repository runs Renovate locally because GitHub restricts private reusable workflows and actions to private callers.
-The approval workflow fetches the pinned shared action with a read-only updater App token.
+The approval workflow calls the pinned public `renovate-config` action directly.
 The separate approval App supplies the review token.
 The updater App needs Contents, Pull requests, Issues, and Workflows write permissions, plus Checks and Commit statuses read permissions.
 
 Before merging the Renovate workflows:
 
-1. Grant `renovate-update-app` access to this repository and `renovate-config`.
+1. Grant `renovate-update-app` access to this repository.
 2. Install `renovatee-approver-stackvista` on this repository.
 3. Apply the `pulumi-infra/github/repoVariables` changes that supply both Apps' credentials.
 4. Check that the live branch protection requires all five CI checks listed in `pulumi-infra/github/repositories/resources.yaml`.

renovate.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>StackVista/renovate-config",
-    "local>StackVista/renovate-config:go"
+    "github>StackVista/renovate-config",
+    "github>StackVista/renovate-config:go"
   ],
   "prConcurrentLimit": 0,
   "prHourlyLimit": 0,