Enable Renovate automerge and update Zizmor checks

[rb3ckers]

Use the shared Go, Docker and automerge presets with scheduled Renovate and approval App workflows. Enable Go module discovery and track the compiler pins in .go-version and go.work together.

Use the standard SHA-pinned Zizmor action and replace the unsupported Actionlint pre-commit hook. Adopt self-repository references without new exceptions and document the approval guard update for default-branch renames.

Uses StackVista/renovate-config#29. Merge and apply StackVista/pulumi-infra#413 first for both Apps’ credentials and access; the updater App also needs Dependabot alerts read access. Pulumi disables agent’s Dependabot security updates while retaining alerts.

Go-only dry-run: 30 candidate PR groups, including 315 routine minor modules grouped into 3 PRs. A security-only module-minor rule would reduce this to 27 groups and preserve all 7 OSV security candidates. That rule is not included. Strict Go filtering may understate the queue; no update PRs were created.

Tracking: StackVista/renovate-config#22

Validation: Renovate schema, compiler extraction, authenticated Zizmor and its pre-commit hook passed. Both dry-run configurations completed successfully.

[LouisParkin]

Verdict: approve-with-nits. The workflow changes are sound: actions are SHA-pinned, permissions are minimal, Zizmor passes, $/ reusable refs run, and commits are signed. Before merging, scope down what enabling gomod turns on.

Medium: Specification

• renovate.json:7: :automerge also auto-merges every gomod require minor update. That applies to all 194 go.mod files in this fork. renovate-config#22 says to auto-merge only module patches and golang.org/x/* minors, and to review other minors by hand. Fix: add a local rule that sets automerge: false for gomod require/replace minor updates outside golang.org/x/**, or fix the preset.
• Dependabot security updates are still enabled on this repo (automated-security-fixes returns enabled: true; Dependabot opened #546 on Oct 15). Neither this PR nor pulumi-infra#413 turns them off, but the description says "keep Dependabot security updates disabled". With gomod and OSV alerts enabled, both bots will raise PRs for the same modules. Fix: disable them through the owning IaC before merging, or correct the description.

Low: Specification

• renovate.json:9,15: enabling gomod together with the Go preset (rangeStrategy: bump for the golang depType) will also bump module go directives. Expect the ~51 go 1.26.0 lines to go into the auto-merged "Go build environment" group, because your golang-version patch rule matches them too. Expect the 141 go 1.25.0 lines to get a minor PR. The repo's own toolchain bump (14159e6) kept these at X.Y.0 and changed only .go-version/go.work. If that convention should hold, add {"matchManagers":["gomod"],"matchDepTypes":["golang"],"enabled":false}.

Low: Standards

• .github/workflows/auto-approve-bot-prs.yml:15: the gate hard-codes refs/heads/stackstate-7.78.2. After the next upstream merge changes the default branch, the approver will stop without any error. Add this rename to the UPSTREAM_MERGE.md checklist.

Merge order: pulumi-infra#413 is still open, and both scheduled workflows depend on it. Lint and DEB CI were still running when this review was written.

[LouisParkin]

Approved with comments