Until now the Trivy and gitleaks pins in .gitea/workflows/*.yml
were manual — Renovate's built-in managers only see
package-manager-tracked deps (npm, docker-compose images, GitHub
Actions, etc.) and ignore plain env vars. We had a comment in
each workflow telling the next contributor to "bump manually
from the releases page", which is exactly the kind of friction
that gets forgotten between two security advisories.
Add a `customManagers` regex in renovate.json that picks up any
`# renovate: datasource=… depName=…` annotation immediately
followed by an env-var assignment of the form
`<NAME>_VERSION: '<version>'`. Annotate the four pins
(TRIVY_VERSION + GITLEAKS_VERSION in ci.yml and
security-scheduled.yml) accordingly, with the github-releases
datasource and the upstream `owner/repo` depName.
The `extractVersionTemplate: ^v?(?<version>.+)$` strips the `v`
prefix used by both projects' release tags so the version
substituted into the env var (which our shell script consumes
without `v`) stays correct.
The dashboard triage header in renovate.json that previously
listed Trivy / gitleaks under "pinned constraints — not Renovate-
tracked yet" is updated to reflect the new tracking.
Verified with a Node-side dry-run of the regex against both
workflow files: 4/4 expected matches with the right datasource /
depName / currentValue captures.
Julien Gautier