From 97c39aa8931842fbb12954d34fe59c73764d8ce9 Mon Sep 17 00:00:00 2001
From: "Zakharov, Ivan" <ivan.zakharov@intel.com>
Date: Tue, 19 May 2026 12:14:59 +0200
Subject: [PATCH 1/4] Disable uv upgrade by renovate bot

---
 .github/renovate.json5         | 17 +++++++++++++++++
 .github/workflows/renovate.yml |  2 ++
 2 files changed, 19 insertions(+)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 21a9c4e3..09d35b1f 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -32,6 +32,23 @@
       schedule: ["* * 1 * *"],
       matchPackageNames: ["*"],
     },
+    // uv version used in GitHub Actions is updated manually
+    {
+      enabled: false,
+      matchDatasources: ["github-releases"],
+      matchDepNames: ["astral-sh/uv"],
+      matchDepTypes: ["uses-with"],
+    },
+  ],
+  // Is used to upgrade Renovate version
+  customManagers: [
+    {
+      fileMatch: ["^\\.github/workflows/[^/]+\\.ya?ml$"],
+      matchStrings: [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+.+version: (?<currentValue>.*)",
+        "# renovate: datasource=(?<datasource>.*?)\\s+export RENOVATE_IMAGE=(?<depName>[^:]+):(?<currentValue>[^@]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?",
+      ],
+    },
   ],
   vulnerabilityAlerts: {
     enabled: true,
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 0b990f3d..1a5c6888 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -77,6 +77,8 @@ jobs:
       - name: Self-hosted Renovate
         uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
         with:
+          # renovate: datasource=github-releases depName=renovatebot/renovate
+          renovate-version: 43.160.7
           configurationFile: .github/renovate.json5
           token: "${{ steps.get-github-app-token.outputs.token }}"
         env:

From 40b2de126a6b92ab08e51014242aa795501d4300 Mon Sep 17 00:00:00 2001
From: "Zakharov, Ivan" <ivan.zakharov@intel.com>
Date: Wed, 20 May 2026 14:52:07 +0200
Subject: [PATCH 2/4] Address config issues

---
 .github/renovate.json5                          | 4 ++--
 .github/workflows/renovate-config-validator.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 09d35b1f..3a4f28fc 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -10,7 +10,7 @@
     "helpers:pinGitHubActionDigests",
   ],
   baseBranchPatterns: ["master"],
-  enabledManagers: ["github-actions", "pep621"],
+  enabledManagers: ["github-actions", "pep621", "custom.regex"],
   ignorePresets: [":prHourlyLimit2"],
   prHourlyLimit: 10,
   packageRules: [
@@ -28,7 +28,7 @@
       enabled: true,
       separateMajorMinor: false,
       groupName: "GitHub Actions",
-      matchManagers: ["github-actions"],
+      matchManagers: ["github-actions", "custom.regex"],
       schedule: ["* * 1 * *"],
       matchPackageNames: ["*"],
     },
diff --git a/.github/workflows/renovate-config-validator.yml b/.github/workflows/renovate-config-validator.yml
index 41a8742c..5ea0c05a 100644
--- a/.github/workflows/renovate-config-validator.yml
+++ b/.github/workflows/renovate-config-validator.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Validate configuration
         run: |
           # renovate: datasource=docker
-          export RENOVATE_IMAGE=ghcr.io/renovatebot/renovate:43.185
+          export RENOVATE_IMAGE=ghcr.io/renovatebot/renovate:43.160.2@sha256:e977df2dbd4b978cc301a0b4d8e0162ec4ce08bd205422c02c4cf55f52b67336
           docker run --rm --entrypoint "renovate-config-validator" \
           -v "${{ github.workspace }}/.github/renovate.json5":"/renovate.json5" \
           ${RENOVATE_IMAGE} "/renovate.json5"

From fd96b65f68454a6dd6ca9c28c5eac5e0d3e2ff84 Mon Sep 17 00:00:00 2001
From: "Zakharov, Ivan" <ivan.zakharov@intel.com>
Date: Thu, 21 May 2026 11:44:19 +0200
Subject: [PATCH 3/4] Fix traffic rules

---
 .github/workflows/renovate-config-validator.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/renovate-config-validator.yml b/.github/workflows/renovate-config-validator.yml
index 3db16c17..f6f9d8b8 100644
--- a/.github/workflows/renovate-config-validator.yml
+++ b/.github/workflows/renovate-config-validator.yml
@@ -37,6 +37,7 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             files.pythonhosted.org:443
+            ghcr.io:443
             github.com:443
             pypi.org:443
             raw.githubusercontent.com:443

From 76443b5f445efc3b3520480e5d7bde17231a4300 Mon Sep 17 00:00:00 2001
From: "Zakharov, Ivan" <ivan.zakharov@intel.com>
Date: Thu, 21 May 2026 12:04:11 +0200
Subject: [PATCH 4/4] Fix traffic rules

---
 .github/workflows/renovate-config-validator.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/renovate-config-validator.yml b/.github/workflows/renovate-config-validator.yml
index f6f9d8b8..df18fb69 100644
--- a/.github/workflows/renovate-config-validator.yml
+++ b/.github/workflows/renovate-config-validator.yml
@@ -39,6 +39,7 @@ jobs:
             files.pythonhosted.org:443
             ghcr.io:443
             github.com:443
+            pkg-containers.githubusercontent.com:443
             pypi.org:443
             raw.githubusercontent.com:443
             releases.astral.sh:443