ci: restore Renovate updates and vulnerability-alert access (#2200)

* ci: restore Renovate updates and vulnerability-alert access

The first Renovate run under the config from #2196 surfaced two regressions.

`minimumReleaseAge: "7 days"` runs under the default
`minimumReleaseAgeBehaviour: timestamp-required`, and the docker datasource
derives a release timestamp for Docker Hub images only. Every ghcr.io update
is therefore held pending regardless of age: run 31591982463 marked uv 0.12.0
through 0.12.3 and the HA container 2026.8.1 pending with
`check: minimumReleaseAge` and no timestamp, and uv 0.12.0 was two weeks old.
`timestamp-optional` keeps the age gate wherever a timestamp exists and stops
blocking where none does.

The same PR narrowed the installation token to four `permission-*` inputs, and
a token that names any permission drops the ones it does not name. The run now
warns `Cannot access vulnerability alerts` and the dashboard carries a
Repository Problems section for it, so the `vulnerabilityAlerts` carve-out
added in the same PR cannot fire. Granting `permission-vulnerability-alerts:
read` is the first step; if the warning survives, the App installation itself
lacks the permission.

Both invariants are pinned by structural tests in the supply-chain shape suite.

* test: pin the release-age gate itself, not only its behaviour

The conditional form passed vacuously if minimumReleaseAge were dropped.

Author: Patch76

.github/workflows/renovate.yml

@@ -44,6 +44,10 @@ jobs:
           permission-contents: write
           permission-issues: write
           permission-pull-requests: write
+          # Without this the vulnerabilityAlerts carve-out in renovate.json is
+          # dead: an installation token that lists any permission-* input drops
+          # every permission it does not name, including vulnerability_alerts.
+          permission-vulnerability-alerts: read
           permission-workflows: write
 
       - name: Self-hosted Renovate

renovate.json

@@ -8,6 +8,7 @@
     "after 3pm on tuesday"
   ],
   "minimumReleaseAge": "7 days",
+  "minimumReleaseAgeBehaviour": "timestamp-optional",
   "vulnerabilityAlerts": {
     "minimumReleaseAge": null
   },

tests/src/unit/test_supply_chain_workflow_shape.py

@@ -1,5 +1,6 @@
 """Guard supply-chain hardening that cannot be exercised by PR workflows."""
 
+import json
 from pathlib import Path
 from typing import Any
 
@@ -99,6 +100,34 @@ def test_pr_checkout_guard_follows_reusable_workflows(tmp_path: Path) -> None:
         _assert_checkout_credentials_are_not_persisted(caller, tmp_path)
 
 
+def test_renovate_token_can_read_vulnerability_alerts() -> None:
+    steps = _workflow(_WORKFLOW_DIR / "renovate.yml")["jobs"]["renovate"]["steps"]
+    token_step = next(
+        step
+        for step in steps
+        if "actions/create-github-app-token" in str(step.get("uses", ""))
+    )
+
+    assert (token_step["with"]).get("permission-vulnerability-alerts") == "read", (
+        "the Renovate token lists permission-* inputs and so drops every "
+        "permission it does not name; without vulnerability_alerts read the "
+        "vulnerabilityAlerts carve-out in renovate.json cannot fire"
+    )
+
+
+def test_renovate_age_gate_tolerates_datasources_without_timestamps() -> None:
+    config = json.loads((_REPO_ROOT / "renovate.json").read_text(encoding="utf-8"))
+
+    assert config.get("minimumReleaseAge") is not None, (
+        "the release-age gate from #2196 is part of the supply-chain contract"
+    )
+    assert config.get("minimumReleaseAgeBehaviour") == "timestamp-optional", (
+        "ghcr.io tags carry no releaseTimestamp - the docker datasource reads it "
+        "from Docker Hub only - so minimumReleaseAge under the default "
+        "timestamp-required behaviour holds every ghcr update pending forever"
+    )
+
+
 def test_dev_release_tag_cleanup_uses_authenticated_github_api() -> None:
     jobs = _workflow(_WORKFLOW_DIR / "publish-dev.yml")["jobs"]
     create_run = next(