[onedr0p]

Rolls the reactive renovate.yaml out to this repo: a config-file push (existing), a Dependency Dashboard checkbox tick, or a merged/edited Renovate PR now dispatches a repo-scoped run immediately instead of waiting for the hourly cron.

Canonical version reviewed and merged in home-operations/flate#862. Uses the org-level vars.BOT_USERNAME variable (already set). This diff also normalizes minor formatting to match the canonical file; dispatch/await/log logic is unchanged.

[greptile-apps]

Greptile Summary

This PR makes Renovate orchestration reactive in addition to its existing push and manual triggers.

• Adds edited-issue and edited/closed pull-request event handling.
• Filters reactive runs using bot identity and Renovate-specific content markers.
• Adds per-event concurrency cancellation.
• Makes reactive dispatches fire-and-forget while preserving completion waiting and logs for push/manual runs.

Confidence Score: 3/5

This PR should not merge until issue-triggered runs verify that the edited issue is the genuine Renovate Dashboard.

User-editable issue title and body text currently provide sufficient authorization to dispatch the shared Renovate workflow for this repository.

.github/workflows/renovate.yaml

Security Review

The issue trigger does not authenticate the genuine Renovate Dashboard, allowing a matching user-controlled issue edit to dispatch repository-scoped Renovate automation.

T-Rex Logs

What T-Rex did

• T-Rex executed an exact-predicate admission harness to verify that untrusted issues trigger Renovate only when the checked-in jobs.renovate.if expression matches.
• T-Rex inspected a malicious-but-safe unrelated issues event fixture to confirm that a non-bot actor and a Renovate Dashboard style message do not falsely admit the job.
• T-Rex observed runtime evaluation that produced FINAL jobs.renovate.if => True and confirmed the admitted job contains the shared Renovate workflow dispatch path.
• T-Rex compared routing states and confirmed the after-state exposes push/manual and qualifying Renovate PR routes while other PR contexts are rejected and await/log is limited to push/manual.
• T-Rex validated an authentication blocker scenario where gh auth status exits non-zero with no authenticated GitHub host, using the reproducible routing harness.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/renovate.yaml	Adds reactive Renovate dispatch and concurrency handling, but the issue admission condition allows unrelated user-controlled issues to trigger the automation.

_{Reviews (1): Last reviewed commit: "ci(renovate): reactive dashboard + confi..." | Re-trigger Greptile}

[greptile-apps]

Untrusted issues trigger Renovate

When a user edits an unrelated issue whose title contains "Renovate Dashboard" and whose body contains a checked task or accepted command, these substring checks admit the event and dispatch the shared Renovate workflow for this repository, allowing user-controlled issues to invoke automation and consume Actions capacity.