From d67b1ae71fb6ff5e5a17fddb16314f5c1b4b01b2 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:07:51 -0500
Subject: [PATCH 01/13] add docs folder which is copy that points at gh-pages
 URls, and setup CI build that updates them (will also add to PRs)

---
 .github/workflows/sync-docs.yml             | 75 +++++++++++++++++++++
 .vscode/settings.json                       |  4 +-
 README.md                                   | 19 ++++++
 docs/README.md                              | 11 +++
 docs/default.json                           |  8 +++
 docs/presets/enableGitSubmodules.json       |  7 ++
 docs/presets/enableVulnerabilityAlerts.json |  8 +++
 docs/presets/group/githubActions.json       | 13 ++++
 docs/presets/group/python.json              | 20 ++++++
 docs/presets/packages/niPython.json         | 14 ++++
 docs/recommended.json                       | 49 ++++++++++++++
 11 files changed, 227 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/sync-docs.yml
 create mode 100644 docs/README.md
 create mode 100644 docs/default.json
 create mode 100644 docs/presets/enableGitSubmodules.json
 create mode 100644 docs/presets/enableVulnerabilityAlerts.json
 create mode 100644 docs/presets/group/githubActions.json
 create mode 100644 docs/presets/group/python.json
 create mode 100644 docs/presets/packages/niPython.json
 create mode 100644 docs/recommended.json

diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
new file mode 100644
index 0000000..7df74cc
--- /dev/null
+++ b/.github/workflows/sync-docs.yml
@@ -0,0 +1,75 @@
+name: Sync docs config mirror
+
+on:
+  push:
+    branches:
+    - main
+    paths:
+    - default.json
+    - recommended.json
+    - presets/**
+    - .github/workflows/sync-docs.yml
+  pull_request:
+    paths:
+    - default.json
+    - recommended.json
+    - presets/**
+    - .github/workflows/sync-docs.yml
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  sync-docs:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: true
+
+    - name: Generate docs mirror
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        docs_dir="docs"
+        pages_base_url="https://ni.github.io/python-renovate-config"
+
+        mkdir -p "${docs_dir}/presets/group" "${docs_dir}/presets/packages"
+        find "${docs_dir}" -type f -name '*.json' -delete
+
+        cp default.json recommended.json "${docs_dir}/"
+        cp presets/*.json "${docs_dir}/presets/"
+        cp presets/group/*.json "${docs_dir}/presets/group/"
+        cp presets/packages/*.json "${docs_dir}/presets/packages/"
+
+        find "${docs_dir}" -type f -name '*.json' -print0 | xargs -0 sed -E -i \
+          -e "s|local>ni/python-renovate-config:([A-Za-z0-9_-]+)|${pages_base_url}/\\1.json|g" \
+          -e "s|local>ni/python-renovate-config//([A-Za-z0-9_./-]+)|${pages_base_url}/\\1.json|g"
+
+    - name: Verify docs mirror is clean
+      shell: bash
+      run: |
+        set -euo pipefail
+        if grep -R "local>ni/python-renovate-config" docs; then
+          echo "Found unresolved local preset references in docs/" >&2
+          exit 1
+        fi
+
+    - name: Commit docs mirror changes
+      if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      shell: bash
+      run: |
+        set -euo pipefail
+        if git diff --quiet -- docs; then
+          exit 0
+        fi
+
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add docs
+        git commit -m "Update generated docs config mirror"
+        git push
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 3948809..c3d5764 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,5 +1,7 @@
 {
     "files.associations": {
         "*.json": "jsonc"
-    }
+    },
+    "snyk.advanced.organization": "f93fdc30-0e2c-4d1d-81a1-9cdae4a561ed",
+    "snyk.advanced.autoSelectOrganization": true
 }
\ No newline at end of file
diff --git a/README.md b/README.md
index 516fa69..9adba46 100644
--- a/README.md
+++ b/README.md
@@ -50,6 +50,25 @@ which some project owners may want to configure differently.
   detected and pulled from the repository before we try to upgrade. This should not affect security
   vulnerability alerts.
 
+## Using From Azure DevOps
+
+If Renovate is running somewhere that cannot resolve this repository's `local>` preset references,
+use the generated mirror under `docs/` instead of referencing the repository root files directly.
+
+Example:
+
+```jsonc
+{
+  "extends": [
+    "https://ni.github.io/python-renovate-config/recommended.json"
+  ]
+}
+```
+
+The GitHub Actions workflow keeps `docs/` in sync, rewrites the inter-file preset links to use
+`https://ni.github.io/python-renovate-config/`, and deploys `docs/` to GitHub Pages so those URLs
+resolve without requiring a GitHub PAT.
+
 ## Presets
 
 ### `presets/enableGitSubmodules.json`
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..42d80ec
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,11 @@
+# Generated Config Mirror
+
+GitHub Actions populates this directory by copying the Renovate config files and presets from the
+repository root and rewriting internal `local>` references to GitHub Pages URLs rooted at:
+
+`https://ni.github.io/python-renovate-config/`
+
+Use `docs/recommended.json` from this directory when a Renovate host cannot resolve GitHub-local
+preset references directly. The JSON files in this directory are generated and should be updated by
+the workflow rather than edited by hand. The workflow also deploys this directory to GitHub Pages,
+where it is served from the site root.
\ No newline at end of file
diff --git a/docs/default.json b/docs/default.json
new file mode 100644
index 0000000..69a10ee
--- /dev/null
+++ b/docs/default.json
@@ -0,0 +1,8 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "config:recommended"
+    ],
+    "branchPrefix": "users/renovate/",
+    "timezone": "US/Central"
+}
\ No newline at end of file
diff --git a/docs/presets/enableGitSubmodules.json b/docs/presets/enableGitSubmodules.json
new file mode 100644
index 0000000..3ee5c2e
--- /dev/null
+++ b/docs/presets/enableGitSubmodules.json
@@ -0,0 +1,7 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "description": "Update Git submodules.",
+    "git-submodules": {
+        "enabled": true
+    }
+}
\ No newline at end of file
diff --git a/docs/presets/enableVulnerabilityAlerts.json b/docs/presets/enableVulnerabilityAlerts.json
new file mode 100644
index 0000000..ad23f8f
--- /dev/null
+++ b/docs/presets/enableVulnerabilityAlerts.json
@@ -0,0 +1,8 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "description": "Raise PR when vulnerability alerts are detected (including OSV alerts).",
+    "extends": [
+        ":enableVulnerabilityAlerts"
+    ],
+    "osvVulnerabilityAlerts": true
+}
\ No newline at end of file
diff --git a/docs/presets/group/githubActions.json b/docs/presets/group/githubActions.json
new file mode 100644
index 0000000..6fa90a9
--- /dev/null
+++ b/docs/presets/group/githubActions.json
@@ -0,0 +1,13 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "description": "Group GitHub Actions together.",
+    "packageRules": [
+        {
+            "matchManagers": [
+                "github-actions"
+            ],
+            "groupName": "GitHub Actions",
+            "groupSlug": "github-actions"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/docs/presets/group/python.json b/docs/presets/group/python.json
new file mode 100644
index 0000000..e313168
--- /dev/null
+++ b/docs/presets/group/python.json
@@ -0,0 +1,20 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "description": "Group Python packages together.",
+    "packageRules": [
+        {
+            "matchCategories": [
+                "python"
+            ],
+            "matchUpdateTypes": [
+                "major",
+                "minor",
+                "patch",
+                "rollback",
+                "replacement"
+            ],
+            "groupName": "Python packages",
+            "groupSlug": "python"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/docs/presets/packages/niPython.json b/docs/presets/packages/niPython.json
new file mode 100644
index 0000000..2e2f158
--- /dev/null
+++ b/docs/presets/packages/niPython.json
@@ -0,0 +1,14 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "description": "All NI Python packages.",
+    "packageRules": [
+        {
+            "matchDatasources": [
+                "pypi"
+            ],
+            "matchPackageNames": [
+                "ni**"
+            ]
+        }
+    ]
+}
\ No newline at end of file
diff --git a/docs/recommended.json b/docs/recommended.json
new file mode 100644
index 0000000..0847541
--- /dev/null
+++ b/docs/recommended.json
@@ -0,0 +1,49 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "https://ni.github.io/python-renovate-config/default.json",
+        "https://ni.github.io/python-renovate-config/presets/enableVulnerabilityAlerts.json",
+        "helpers:pinGitHubActionDigestsToSemver",
+        // Run lock file maintenance monthly in order to upgrade indirect
+        // dependencies that are not covered by the weekly update, such as
+        // `certifi` or `typing_extensions`.
+        ":maintainLockFilesMonthly",
+        ":rebaseStalePrs"
+    ],
+    // Do not upgrade to new package versions as soon as they are released. If
+    // an upstream package is compromised, delaying makes it more likely that
+    // the compromised version will be detected and pulled from the repository
+    // before we try to upgrade. This should not affect security vulnerability
+    // alerts.
+    "minimumReleaseAge": "14 days",
+    "packageRules": [
+        {
+            "description": "Update GitHub Actions on Sundays.",
+            "extends": [
+                "https://ni.github.io/python-renovate-config/presets/group/githubActions.json"
+            ],
+            "schedule": ["* * * * 0"]
+        },
+        {
+            "description": "Update Python packages on Sundays.",
+            "extends": [
+                "https://ni.github.io/python-renovate-config/presets/group/python.json"
+            ],
+            "schedule": ["* * * * 0"]
+        },
+        {
+            "description": "Set minimumReleaseAge to 1 day for ni/python-actions.",
+            "matchPackageNames": [
+                "ni/python-actions"
+            ],
+            "minimumReleaseAge": "1 day"
+        },
+        {
+            "description": "Set minimumReleaseAge to 1 day for NI Python packages.",
+            "extends": [
+                "https://ni.github.io/python-renovate-config/presets/packages/niPython.json"
+            ],
+            "minimumReleaseAge": "1 day"
+        }
+    ]
+}
\ No newline at end of file

From 8dfc1ddc7a70bb7c58807b1e6866881b7e65e425 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:08:05 -0500
Subject: [PATCH 02/13] Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/sync-docs.yml | 6 ++++++
 README.md                       | 3 +--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
index 7df74cc..44574b9 100644
--- a/.github/workflows/sync-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -59,6 +59,12 @@ jobs:
           exit 1
         fi
 
+        if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && ! git diff --quiet -- docs; then
+          echo "docs/ is out of sync with the source configs; regenerate it (via this workflow) and commit the updated docs/ output." >&2
+          git --no-pager diff -- docs >&2
+          exit 1
+        fi
+
     - name: Commit docs mirror changes
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       shell: bash
diff --git a/README.md b/README.md
index 9adba46..9d6f361 100644
--- a/README.md
+++ b/README.md
@@ -66,8 +66,7 @@ Example:
 ```
 
 The GitHub Actions workflow keeps `docs/` in sync, rewrites the inter-file preset links to use
-`https://ni.github.io/python-renovate-config/`, and deploys `docs/` to GitHub Pages so those URLs
-resolve without requiring a GitHub PAT.
+`https://ni.github.io/python-renovate-config/`, and commits `docs/` so GitHub Pages (configured to publish from `docs/`) can serve those URLs without requiring a GitHub PAT.
 
 ## Presets
 

From 5a984cb9ba449c360e0d5e28fd2949990b635387 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:08:05 -0500
Subject: [PATCH 03/13] split checking vs publishing to reduce permissions

---
 .github/workflows/sync-docs.yml | 40 +++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
index 44574b9..bf01918 100644
--- a/.github/workflows/sync-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -18,17 +18,17 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  sync-docs:
+  validate-docs:
     runs-on: ubuntu-latest
 
     steps:
     - name: Check out repository
       uses: actions/checkout@v4
       with:
-        persist-credentials: true
+        persist-credentials: false
 
     - name: Generate docs mirror
       shell: bash
@@ -65,8 +65,40 @@ jobs:
           exit 1
         fi
 
+  publish-docs:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: validate-docs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: true
+
+    - name: Generate docs mirror
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        docs_dir="docs"
+        pages_base_url="https://ni.github.io/python-renovate-config"
+
+        mkdir -p "${docs_dir}/presets/group" "${docs_dir}/presets/packages"
+        find "${docs_dir}" -type f -name '*.json' -delete
+
+        cp default.json recommended.json "${docs_dir}/"
+        cp presets/*.json "${docs_dir}/presets/"
+        cp presets/group/*.json "${docs_dir}/presets/group/"
+        cp presets/packages/*.json "${docs_dir}/presets/packages/"
+
+        find "${docs_dir}" -type f -name '*.json' -print0 | xargs -0 sed -E -i \
+          -e "s|local>ni/python-renovate-config:([A-Za-z0-9_-]+)|${pages_base_url}/\\1.json|g" \
+          -e "s|local>ni/python-renovate-config//([A-Za-z0-9_./-]+)|${pages_base_url}/\\1.json|g"
+
     - name: Commit docs mirror changes
-      if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       shell: bash
       run: |
         set -euo pipefail

From e966306a38633f5ac2bbe48feb78dff54ae0dc1a Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:08:06 -0500
Subject: [PATCH 04/13] revert this again

---
 .vscode/settings.json | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.vscode/settings.json b/.vscode/settings.json
index c3d5764..3948809 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,7 +1,5 @@
 {
     "files.associations": {
         "*.json": "jsonc"
-    },
-    "snyk.advanced.organization": "f93fdc30-0e2c-4d1d-81a1-9cdae4a561ed",
-    "snyk.advanced.autoSelectOrganization": true
+    }
 }
\ No newline at end of file

From 54aefe014abd70f1235456dfc2d523800d160e8e Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:16:54 -0500
Subject: [PATCH 05/13] single source sinc-docs.sh

---
 .github/workflows/sync-docs.sh  | 18 +++++++++++++++++
 .github/workflows/sync-docs.yml | 36 ++++-----------------------------
 2 files changed, 22 insertions(+), 32 deletions(-)
 create mode 100644 .github/workflows/sync-docs.sh

diff --git a/.github/workflows/sync-docs.sh b/.github/workflows/sync-docs.sh
new file mode 100644
index 0000000..961defa
--- /dev/null
+++ b/.github/workflows/sync-docs.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+docs_dir="docs"
+pages_base_url="https://ni.github.io/python-renovate-config"
+
+mkdir -p "${docs_dir}/presets/group" "${docs_dir}/presets/packages"
+find "${docs_dir}" -type f -name '*.json' -delete
+
+cp default.json recommended.json "${docs_dir}/"
+cp presets/*.json "${docs_dir}/presets/"
+cp presets/group/*.json "${docs_dir}/presets/group/"
+cp presets/packages/*.json "${docs_dir}/presets/packages/"
+
+find "${docs_dir}" -type f -name '*.json' -print0 | xargs -0 sed -E -i \
+  -e "s|local>ni/python-renovate-config:([A-Za-z0-9_-]+)|${pages_base_url}/\\1.json|g" \
+  -e "s|local>ni/python-renovate-config//([A-Za-z0-9_./-]+)|${pages_base_url}/\\1.json|g"
diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
index bf01918..002caf5 100644
--- a/.github/workflows/sync-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -9,12 +9,14 @@ on:
     - recommended.json
     - presets/**
     - .github/workflows/sync-docs.yml
+    - .github/workflows/sync-docs.sh
   pull_request:
     paths:
     - default.json
     - recommended.json
     - presets/**
     - .github/workflows/sync-docs.yml
+    - .github/workflows/sync-docs.sh
   workflow_dispatch:
 
 permissions:
@@ -33,22 +35,7 @@ jobs:
     - name: Generate docs mirror
       shell: bash
       run: |
-        set -euo pipefail
-
-        docs_dir="docs"
-        pages_base_url="https://ni.github.io/python-renovate-config"
-
-        mkdir -p "${docs_dir}/presets/group" "${docs_dir}/presets/packages"
-        find "${docs_dir}" -type f -name '*.json' -delete
-
-        cp default.json recommended.json "${docs_dir}/"
-        cp presets/*.json "${docs_dir}/presets/"
-        cp presets/group/*.json "${docs_dir}/presets/group/"
-        cp presets/packages/*.json "${docs_dir}/presets/packages/"
-
-        find "${docs_dir}" -type f -name '*.json' -print0 | xargs -0 sed -E -i \
-          -e "s|local>ni/python-renovate-config:([A-Za-z0-9_-]+)|${pages_base_url}/\\1.json|g" \
-          -e "s|local>ni/python-renovate-config//([A-Za-z0-9_./-]+)|${pages_base_url}/\\1.json|g"
+        bash .github/workflows/sync-docs.sh
 
     - name: Verify docs mirror is clean
       shell: bash
@@ -81,22 +68,7 @@ jobs:
     - name: Generate docs mirror
       shell: bash
       run: |
-        set -euo pipefail
-
-        docs_dir="docs"
-        pages_base_url="https://ni.github.io/python-renovate-config"
-
-        mkdir -p "${docs_dir}/presets/group" "${docs_dir}/presets/packages"
-        find "${docs_dir}" -type f -name '*.json' -delete
-
-        cp default.json recommended.json "${docs_dir}/"
-        cp presets/*.json "${docs_dir}/presets/"
-        cp presets/group/*.json "${docs_dir}/presets/group/"
-        cp presets/packages/*.json "${docs_dir}/presets/packages/"
-
-        find "${docs_dir}" -type f -name '*.json' -print0 | xargs -0 sed -E -i \
-          -e "s|local>ni/python-renovate-config:([A-Za-z0-9_-]+)|${pages_base_url}/\\1.json|g" \
-          -e "s|local>ni/python-renovate-config//([A-Za-z0-9_./-]+)|${pages_base_url}/\\1.json|g"
+        bash .github/workflows/sync-docs.sh
 
     - name: Commit docs mirror changes
       shell: bash

From 312b3c1ed2bcc175047ab01792080e9e01875cbe Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:18:23 -0500
Subject: [PATCH 06/13] limit concurrency

---
 .github/workflows/sync-docs.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
index 002caf5..1855b9d 100644
--- a/.github/workflows/sync-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -22,6 +22,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate-docs:
     runs-on: ubuntu-latest

From 371fc89a811ff50ab0fe7567c02c1fceabf12331 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:28:56 -0500
Subject: [PATCH 07/13] add zizmor, CI build, and re-arrange

---
 .github/workflows/CI.yml            | 21 +++++++
 .github/workflows/PR.yml            | 22 +++++++
 .github/workflows/check_actions.yml | 21 +++++++
 .github/workflows/check_docs.yml    | 42 ++++++++++++++
 .github/workflows/sync-docs.yml     | 89 -----------------------------
 5 files changed, 106 insertions(+), 89 deletions(-)
 create mode 100644 .github/workflows/CI.yml
 create mode 100644 .github/workflows/PR.yml
 create mode 100644 .github/workflows/check_actions.yml
 create mode 100644 .github/workflows/check_docs.yml
 delete mode 100644 .github/workflows/sync-docs.yml

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
new file mode 100644
index 0000000..36ef346
--- /dev/null
+++ b/.github/workflows/CI.yml
@@ -0,0 +1,21 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - 'releases/**'
+  workflow_call:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  check_actions:
+    name: Check actions
+    uses: ./.github/workflows/check_actions.yml
+    permissions:
+      security-events: write
+  check_docs:
+    name: Check docs
+    uses: ./.github/workflows/check_docs.yml
diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
new file mode 100644
index 0000000..1522824
--- /dev/null
+++ b/.github/workflows/PR.yml
@@ -0,0 +1,22 @@
+name: PR
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'releases/**'
+  workflow_call:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  run_ci:
+    name: Run CI
+    uses: ./.github/workflows/CI.yml
+    permissions:
+      security-events: write
diff --git a/.github/workflows/check_actions.yml b/.github/workflows/check_actions.yml
new file mode 100644
index 0000000..edc83dd
--- /dev/null
+++ b/.github/workflows/check_actions.yml
@@ -0,0 +1,21 @@
+name: Check actions
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
diff --git a/.github/workflows/check_docs.yml b/.github/workflows/check_docs.yml
new file mode 100644
index 0000000..6df3edf
--- /dev/null
+++ b/.github/workflows/check_docs.yml
@@ -0,0 +1,42 @@
+name: Sync docs config mirror
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate-docs:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+
+    - name: Generate docs mirror
+      shell: bash
+      run: |
+        bash .github/workflows/sync-docs.sh
+
+    - name: Verify docs mirror is clean
+      shell: bash
+      run: |
+        set -euo pipefail
+        if grep -R "local>ni/python-renovate-config" docs; then
+          echo "Found unresolved local preset references in docs/" >&2
+          exit 1
+        fi
+
+        if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && ! git diff --quiet -- docs; then
+          echo "docs/ is out of sync with the source configs; regenerate it (by running .github/workflows/sync-docs.sh) and commit the updated docs/ output." >&2
+          git --no-pager diff -- docs >&2
+          exit 1
+        fi
diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
deleted file mode 100644
index 1855b9d..0000000
--- a/.github/workflows/sync-docs.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: Sync docs config mirror
-
-on:
-  push:
-    branches:
-    - main
-    paths:
-    - default.json
-    - recommended.json
-    - presets/**
-    - .github/workflows/sync-docs.yml
-    - .github/workflows/sync-docs.sh
-  pull_request:
-    paths:
-    - default.json
-    - recommended.json
-    - presets/**
-    - .github/workflows/sync-docs.yml
-    - .github/workflows/sync-docs.sh
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  validate-docs:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v4
-      with:
-        persist-credentials: false
-
-    - name: Generate docs mirror
-      shell: bash
-      run: |
-        bash .github/workflows/sync-docs.sh
-
-    - name: Verify docs mirror is clean
-      shell: bash
-      run: |
-        set -euo pipefail
-        if grep -R "local>ni/python-renovate-config" docs; then
-          echo "Found unresolved local preset references in docs/" >&2
-          exit 1
-        fi
-
-        if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && ! git diff --quiet -- docs; then
-          echo "docs/ is out of sync with the source configs; regenerate it (via this workflow) and commit the updated docs/ output." >&2
-          git --no-pager diff -- docs >&2
-          exit 1
-        fi
-
-  publish-docs:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    needs: validate-docs
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v4
-      with:
-        persist-credentials: true
-
-    - name: Generate docs mirror
-      shell: bash
-      run: |
-        bash .github/workflows/sync-docs.sh
-
-    - name: Commit docs mirror changes
-      shell: bash
-      run: |
-        set -euo pipefail
-        if git diff --quiet -- docs; then
-          exit 0
-        fi
-
-        git config user.name "github-actions[bot]"
-        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-        git add docs
-        git commit -m "Update generated docs config mirror"
-        git push

From 1ca78c2cffb8255258a3c8892a00c1a921cf4d80 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:34:47 -0500
Subject: [PATCH 08/13] allow the PR to read the repo

---
 .github/workflows/CI.yml | 3 ++-
 .github/workflows/PR.yml | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 36ef346..766c186 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -8,7 +8,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   check_actions:
diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index 1522824..8eb0f01 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -8,7 +8,8 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

From 7e4f38180a19f9aa7ad498d34d71b9b97ee12a94 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:39:38 -0500
Subject: [PATCH 09/13] include read permission in the pass down

---
 .github/workflows/PR.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index 8eb0f01..544fb40 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -21,3 +21,4 @@ jobs:
     uses: ./.github/workflows/CI.yml
     permissions:
       security-events: write
+      contents: read

From 04e9e5b79a9f28cf50ee92cb21246ff1f49199bd Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:42:01 -0500
Subject: [PATCH 10/13] upgrade and hash-pin the checkout action

---
 .github/workflows/check_docs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check_docs.yml b/.github/workflows/check_docs.yml
index 6df3edf..9f707d2 100644
--- a/.github/workflows/check_docs.yml
+++ b/.github/workflows/check_docs.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
     - name: Check out repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
 

From 3fc407985b7e3bf5e2861cb5cf55a9ace625e1e1 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:50:56 -0500
Subject: [PATCH 11/13] more cleanup

---
 .github/workflows/check_docs.yml | 5 +----
 README.md                        | 5 ++---
 docs/README.md                   | 7 ++-----
 3 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/check_docs.yml b/.github/workflows/check_docs.yml
index 9f707d2..14d66ef 100644
--- a/.github/workflows/check_docs.yml
+++ b/.github/workflows/check_docs.yml
@@ -7,9 +7,6 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
 
 jobs:
   validate-docs:
@@ -35,7 +32,7 @@ jobs:
           exit 1
         fi
 
-        if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && ! git diff --quiet -- docs; then
+        if ! git diff --quiet -- docs; then
           echo "docs/ is out of sync with the source configs; regenerate it (by running .github/workflows/sync-docs.sh) and commit the updated docs/ output." >&2
           git --no-pager diff -- docs >&2
           exit 1
diff --git a/README.md b/README.md
index 9d6f361..f51a287 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,7 @@ which some project owners may want to configure differently.
   detected and pulled from the repository before we try to upgrade. This should not affect security
   vulnerability alerts.
 
-## Using From Azure DevOps
+## Using Outside of GitHub repos
 
 If Renovate is running somewhere that cannot resolve this repository's `local>` preset references,
 use the generated mirror under `docs/` instead of referencing the repository root files directly.
@@ -65,8 +65,7 @@ Example:
 }
 ```
 
-The GitHub Actions workflow keeps `docs/` in sync, rewrites the inter-file preset links to use
-`https://ni.github.io/python-renovate-config/`, and commits `docs/` so GitHub Pages (configured to publish from `docs/`) can serve those URLs without requiring a GitHub PAT.
+PR builds validate that `docs/` in sync, and a script is provided to keep it in sync.
 
 ## Presets
 
diff --git a/docs/README.md b/docs/README.md
index 42d80ec..8628d22 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,11 +1,8 @@
 # Generated Config Mirror
 
-GitHub Actions populates this directory by copying the Renovate config files and presets from the
-repository root and rewriting internal `local>` references to GitHub Pages URLs rooted at:
+`.github/workflows/sync-docs.sh` populates this directory by copying the config fils and rewriting internal `local>` references to the GitHb Pages URLs rooted at:
 
 `https://ni.github.io/python-renovate-config/`
 
 Use `docs/recommended.json` from this directory when a Renovate host cannot resolve GitHub-local
-preset references directly. The JSON files in this directory are generated and should be updated by
-the workflow rather than edited by hand. The workflow also deploys this directory to GitHub Pages,
-where it is served from the site root.
\ No newline at end of file
+preset references directly. The JSON files in this directory are generated and should be updated using the script rather than edited by hand.
\ No newline at end of file

From 618b393ee2621bc0e02e2b5aa8c49881ff1b23b7 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:56:54 -0500
Subject: [PATCH 12/13] Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 README.md      | 2 +-
 docs/README.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f51a287..c23bb86 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ Example:
 }
 ```
 
-PR builds validate that `docs/` in sync, and a script is provided to keep it in sync.
+PR builds validate that `docs/` is in sync, and a script is provided to keep it in sync.
 
 ## Presets
 
diff --git a/docs/README.md b/docs/README.md
index 8628d22..14c8db7 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,6 +1,6 @@
 # Generated Config Mirror
 
-`.github/workflows/sync-docs.sh` populates this directory by copying the config fils and rewriting internal `local>` references to the GitHb Pages URLs rooted at:
+`.github/workflows/sync-docs.sh` populates this directory by copying the config files and rewriting internal `local>` references to the GitHub Pages URLs rooted at:
 
 `https://ni.github.io/python-renovate-config/`
 

From 8980d13001d230c59d9c80bd7ff6d0e9f7858db6 Mon Sep 17 00:00:00 2001
From: mshafer-NI <23644905+mshafer-NI@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:58:58 -0500
Subject: [PATCH 13/13] try a minimal permissions set

---
 .github/workflows/CI.yml         | 3 +--
 .github/workflows/PR.yml         | 4 +---
 .github/workflows/check_docs.yml | 4 ----
 3 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 766c186..36ef346 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -8,8 +8,7 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   check_actions:
diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index 544fb40..1522824 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -8,8 +8,7 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -21,4 +20,3 @@ jobs:
     uses: ./.github/workflows/CI.yml
     permissions:
       security-events: write
-      contents: read
diff --git a/.github/workflows/check_docs.yml b/.github/workflows/check_docs.yml
index 14d66ef..2e8f154 100644
--- a/.github/workflows/check_docs.yml
+++ b/.github/workflows/check_docs.yml
@@ -4,10 +4,6 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
-
-
 jobs:
   validate-docs:
     runs-on: ubuntu-latest