Update renovate config to:

[bckohan]

1. Updates GHA hashes in my workflows
2. Restricts hashes to GitHub release tags but uses the commit hash instead of the tag name
3. Has a cool off period of 1 month
4. Batches PRs and submits no more than 1 per week

[Copilot]

Pull request overview

Updates the repository’s Renovate configuration to focus on GitHub Actions updates, enforce digest pinning, and reduce PR noise via batching and scheduling.

Changes:

• Switch Renovate preset to config:base and enable only the github-actions manager.
• Enable digest pinning for GitHub Actions and constrain updates to release-like tag versions.
• Add a 30-day stability window and a weekly (Monday) schedule with a single concurrent PR, grouping all GHA updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description doesn’t mention changing the preset from config:recommended to config:base. This can materially change Renovate defaults (e.g., what it considers “recommended” behaviors), so if the intent is only scheduling/batching/pinning changes, consider keeping config:recommended (or explicitly re-adding any lost defaults) to avoid an accidental behavior change.

[Copilot]

enabledManagers: ["github-actions"] restricts Renovate to only GitHub Actions. In this repo that will also stop Renovate from updating other dependency sources (e.g., pyproject.toml / uv.lock) if you previously relied on it. If you still want non-GHA updates, remove enabledManagers or broaden it to include the other managers you use.

[Copilot]

schedule: ["on monday"] is evaluated in Renovate’s configured timezone (UTC by default). If you expect “Monday” in a specific local/business timezone, add an explicit timezone setting so Renovate doesn’t potentially start the weekly PR on Sunday/Tuesday relative to your local time.