What problem does it solve? Dependency update bots often miss manifests, leave lock files and integrity hashes stale, or pull in releases that are hours old. This Skill sets up or extends Renovate so every dependency declaration in a repository is inventoried, mapped to the right manager, and updated immutably with a seven-day minimum release age. ## Core Features & Use Cases - Full dependency inventory: Scans all tracked files for manifests, lock files, GitHub Action SHAs, container image digests, mise tools, and versions hidden in URLs or scripts. - Immutable update strategy: Pins GitHub Actions to full commit SHAs with readable version comments, pins container images to digests, and keeps lock files and integrity hashes refreshed via lockfile maintenance. - Cooldown enforcement: Applies minimumReleaseAge: "7 days" across merged presets and package rules, preserving longer existing minimums and reporting data sources without usable timestamps. - Use Case: When migrating from Dependabot to Renovate, use this Skill to inventory every dependency declaration, merge a minimal validated config, and prove extraction with a dry run before activating the bot. ## Quick Start Ask the assistant to set up Renovate for this repository with a seven-day minimum release age, digest pinning for actions and images, and lockfile maintenance.
