build: pin every dependency to an exact version, including runtime tool installs (#77)

* build(renovate): pin every dependency to an exact version

Org-wide policy: no ranges, in any repo, in any ecosystem. A range means the
version you get depends on when you install -- CI, a laptop and a release build
can each resolve differently -- and a bad upstream release lands without a PR
anyone reviewed.

Renovate now raises a "Pin dependencies" PR for anything that regresses to a
range, and every upgrade arrives as a reviewable PR that CI has to pass. That is
the point rather than the cost: the same number of upgrades, each one visible.

A survey found the repos were already almost entirely pinned -- Maven and Gradle
had no ranges at all, and only four dependencies across two repos needed
changing (reqstool-vscode#103, reqstool-client#440). This keeps them that way.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

* build(ci): pin the tools the workflows install at runtime

The earlier survey only looked at package manifests, and missed a whole class of
dependency: tools installed inside a workflow. They execute in CI and some of
them feed a publish, so an unpinned one is exactly the risk pinning exists to
remove.

Worst of them was `docker run renovate/renovate` with no tag at all -- :latest on
every run, so that job's behaviour could change with no commit anywhere. Now
44.32.5.

Also pinned: zizmor 1.29.0, yamllint 1.38.0, PyYAML 6.0.3, hatch 1.18.0, twine
7.0.0, @fission-ai/openspec 1.9.0. Each carries a `# renovate:` comment, so they
are tracked rather than merely frozen -- the distinction the four earlier pins
were about.

The custom manager gains one matchString for the inline `tool==1.2.3` and
`pkg@1.2.3` forms. The docker image reuses the existing `VERSION="..."` form via
a variable, rather than a third pattern: an inline comment there would have
needed backticks, which bash would have run as command substitution.

install-reqstool stays unpinned on purpose, and now says so. The build matrix
runs it with reqstool-source: [pypi, main] precisely to test against whatever
reqstool currently releases; pinning it would defeat the check it exists for.

Verified all ten annotations are discovered by the manager's regexes.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

---------

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/actions/install-reqstool/action.yml

@@ -27,5 +27,8 @@ runs:
         if [ "$REQSTOOL_SOURCE" = "main" ]; then
           pip install "reqstool @ git+https://github.com/reqstool/reqstool-client.git@main"
         else
+          # Deliberately unpinned. The build matrix runs this with
+          # reqstool-source: [pypi, main] precisely to test against whatever
+          # reqstool currently releases; pinning would defeat the check.
           pip install reqstool
         fi

.github/renovate.json5

@@ -6,6 +6,15 @@
     ":semanticCommits",
   ],
 
+  // Every dependency is pinned to an exact version, in every repo. A range means
+  // the version you get depends on when you install: CI, a laptop and a release
+  // build can each resolve differently, and a bad upstream release lands without
+  // a PR anyone reviewed. Pinning turns each upgrade into a reviewable PR that CI
+  // has to pass -- which is the point, not extra noise.
+  //
+  // Renovate raises "Pin dependencies" PRs for anything that regresses to a range.
+  rangeStrategy: "pin",
+
   semanticCommits: "enabled",
   semanticCommitType: "chore",
   semanticCommitScope: "{{datasource}}",
@@ -61,6 +70,7 @@
       matchStrings: [
         "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>\\S+)\\s+default: \"(?<currentValue>[^\"]+)\"",
         "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>\\S+)\\s+VERSION=\"(?<currentValue>[^\"]+)\"",
+        "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>\\S+)\\s+[^\\n]*?(?:==|@)(?<currentValue>[0-9][^\\s\"']*)",
       ],
     },
   ],

.github/workflows/ci.yml

@@ -34,10 +34,12 @@ jobs:
           sudo mv actionlint /usr/local/bin/
 
       - name: Install zizmor
-        run: pip install zizmor
+        # renovate: datasource=pypi depName=zizmor
+        run: pip install zizmor==1.29.0
 
       - name: Install yamllint
-        run: pip install yamllint
+        # renovate: datasource=pypi depName=yamllint
+        run: pip install yamllint==1.38.0
 
       # The ignore covers exactly one thing: actionlint does not yet know the
       # `$/` self-repository syntax GitHub shipped on 2026-07-30, and rejects it
@@ -89,7 +91,8 @@ jobs:
       # script for why this specific shape is worth a test.
       - name: Check reusable workflow permissions
         run: |
-          pip install --quiet pyyaml
+          # renovate: datasource=pypi depName=PyYAML
+          pip install --quiet PyYAML==6.0.3
           python3 tests/actions/check-permissions.py
 
   # Proves the `$/` self-repository syntax actually resolves on a runner, rather

.github/workflows/common-validate-openspec.yml

@@ -35,5 +35,6 @@ jobs:
 
       - name: Validate OpenSpec specs
         run: |
-          npm install -g @fission-ai/openspec
+          # renovate: datasource=npm depName=@fission-ai/openspec
+          npm install -g @fission-ai/openspec@1.9.0
           openspec validate --specs --strict

.github/workflows/common-validate-renovate.yml

@@ -25,7 +25,9 @@ jobs:
         env:
           CONFIG_PATH: ${{ inputs.config-path }}
         run: |
+          # renovate: datasource=docker depName=renovate/renovate
+          VERSION="44.32.5"
           docker run --rm \
             -v "$GITHUB_WORKSPACE:/repo" \
-            renovate/renovate \
+            "renovate/renovate:$VERSION" \
             renovate-config-validator "/repo/$CONFIG_PATH"

.github/workflows/python-build-hatch.yml

@@ -55,7 +55,8 @@ jobs:
         with:
           python-version: ${{ inputs.python-version }}
 
-      - run: pip install hatch
+      # renovate: datasource=pypi depName=hatch
+      - run: pip install hatch==1.18.0
 
       - name: Run tests (with coverage)
         if: ${{ inputs.coverage-source != '' }}

.github/workflows/python-publish-to-pypi.yml

@@ -64,7 +64,8 @@ jobs:
       - name: Dry-run — validate artifacts
         if: ${{ inputs.dry-run }}
         run: |
-          pip install --quiet twine
+          # renovate: datasource=pypi depName=twine
+          pip install --quiet twine==7.0.0
           twine check --strict dist/*
 
       - name: Publish to Test PyPI