[Github] Add renovate configuration for Github Actions

[renovate-bot]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

---

Detected Package Files

• third-party/benchmark/bazel/benchmark_deps.bzl (bazel)
• utils/bazel/WORKSPACE (bazel)
• third-party/benchmark/MODULE.bazel (bazel-module)
• utils/bazel/.bazelversion (bazelisk)
• libcxx/utils/ci/docker-compose.yml (docker-compose)
• .ci/metrics/Dockerfile (dockerfile)
• .github/workflows/containers/github-action-ci-windows/Dockerfile (dockerfile)
• .github/workflows/containers/github-action-ci/Dockerfile (dockerfile)
• bolt/utils/docker/Dockerfile (dockerfile)
• clang/tools/clang-fuzzer/Dockerfile (dockerfile)
• clang/utils/analyzer/Dockerfile (dockerfile)
• libc/utils/buildbot/Dockerfile (dockerfile)
• libcxx/utils/ci/Dockerfile (dockerfile)
• llvm/utils/docker/debian12/Dockerfile (dockerfile)
• llvm/utils/docker/example/Dockerfile (dockerfile)
• llvm/utils/docker/nvidia-cuda/Dockerfile (dockerfile)
• .github/workflows/bazel-checks.yml (github-actions)
• .github/workflows/build-ci-container-windows.yml (github-actions)
• .github/workflows/build-ci-container.yml (github-actions)
• .github/workflows/build-metrics-container.yml (github-actions)
• .github/workflows/check-ci.yml (github-actions)
• .github/workflows/ci-post-commit-analyzer.yml (github-actions)
• .github/workflows/commit-access-greeter.yml (github-actions)
• .github/workflows/commit-access-review.yml (github-actions)
• .github/workflows/docs.yml (github-actions)
• .github/workflows/email-check.yaml (github-actions)
• .github/workflows/gha-codeql.yml (github-actions)
• .github/workflows/hlsl-test-all.yaml (github-actions)
• .github/workflows/issue-release-workflow.yml (github-actions)
• .github/workflows/issue-subscriber.yml (github-actions)
• .github/workflows/issue-write.yml (github-actions)
• .github/workflows/libc-fullbuild-tests.yml (github-actions)
• .github/workflows/libc-overlay-tests.yml (github-actions)
• .github/workflows/libclang-abi-tests.yml (github-actions)
• .github/workflows/libclang-python-tests.yml (github-actions)
• .github/workflows/libcxx-build-and-test.yaml (github-actions)
• .github/workflows/libcxx-build-containers.yml (github-actions)
• .github/workflows/libcxx-check-generated-files.yml (github-actions)
• .github/workflows/libcxx-run-benchmarks.yml (github-actions)
• .github/workflows/llvm-bugs.yml (github-actions)
• .github/workflows/llvm-tests.yml (github-actions)
• .github/workflows/merged-prs.yml (github-actions)
• .github/workflows/mlir-spirv-tests.yml (github-actions)
• .github/workflows/new-issues.yml (github-actions)
• .github/workflows/new-prs.yml (github-actions)
• .github/workflows/pr-code-format.yml (github-actions)
• .github/workflows/pr-code-lint.yml (github-actions)
• .github/workflows/pr-request-release-note.yml (github-actions)
• .github/workflows/pr-subscriber.yml (github-actions)
• .github/workflows/premerge.yaml (github-actions)
• .github/workflows/release-asset-audit.yml (github-actions)
• .github/workflows/release-binaries-all.yml (github-actions)
• .github/workflows/release-binaries-save-stage/action.yml (github-actions)
• .github/workflows/release-binaries-setup-stage/action.yml (github-actions)
• .github/workflows/release-binaries.yml (github-actions)
• .github/workflows/release-documentation.yml (github-actions)
• .github/workflows/release-doxygen.yml (github-actions)
• .github/workflows/release-lit.yml (github-actions)
• .github/workflows/release-sources.yml (github-actions)
• .github/workflows/release-tasks.yml (github-actions)
• .github/workflows/scorecard.yml (github-actions)
• .github/workflows/spirv-tests.yml (github-actions)
• .github/workflows/unprivileged-download-artifact/action.yml (github-actions)
• .github/workflows/version-check.yml (github-actions)
• lldb/tools/lldb-dap/package.json (npm)
• llvm/utils/vscode/llvm/package.json (npm)
• mlir/utils/tree-sitter-mlir/package.json (npm)
• mlir/utils/vscode/package.json (npm)
• llvm/utils/lit/pyproject.toml (pep621)
• llvm/utils/mlgo-utils/pyproject.toml (pep621)
• .ci/all_requirements.txt (pip_requirements)
• .ci/metrics/requirements.lock.txt (pip_requirements)
• .ci/metrics/requirements.txt (pip_requirements)
• .ci/requirements.txt (pip_requirements)
• clang/utils/analyzer/requirements.txt (pip_requirements)
• libcxx/utils/requirements.txt (pip_requirements)
• llvm/docs/requirements-hashed.txt (pip_requirements)
• llvm/docs/requirements.txt (pip_requirements)
• llvm/utils/git/requirements.txt (pip_requirements)
• mlir/python/requirements.txt (pip_requirements)
• third-party/benchmark/tools/requirements.txt (pip_requirements)
• third-party/benchmark/pyproject.toml (poetry)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

What to Expect

With your current configuration, Renovate will create 138 Pull Requests:

Update actions/setup-python digest to 4267e28

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-python-digest
• Merge into: main
• Upgrade actions/setup-python to 4267e283df95c05d9f16ece6624106f44613b489

Update EnricoMi/publish-unit-test-result-action digest to 3a74b29

• Schedule: ["at any time"]
• Branch name: renovate/enricomi-publish-unit-test-result-action-digest
• Merge into: main
• Upgrade EnricoMi/publish-unit-test-result-action to 3a74b2957438d0b6e2e61d67b05318aa25c9e6c6

Update llvm/actions digest to a1ea791

• Schedule: ["at any time"]
• Branch name: renovate/llvm-actions-digest
• Merge into: main
• Upgrade llvm/actions to a1ea791b03c8e61f53a0e66f2f73db283aa0f01e

Update vulkan_headers digest to d7a7044

• Schedule: ["at any time"]
• Branch name: renovate/vulkan_headers-digest
• Merge into: main
• Upgrade vulkan_headers to d7a7044334ad88485c0a6113d1bf51520ac9e541

Update actions/upload-artifact action to v4.6.2

• Schedule: ["at any time"]
• Branch name: renovate/actions-upload-artifact-4.x
• Merge into: main
• Upgrade actions/upload-artifact to ea165f8d65b6e75b540449e92b4886f43607fa02

Update dependency @​types/node to v14.18.63

• Schedule: ["at any time"]
• Branch name: renovate/node-14.x-lockfile
• Merge into: main
• Upgrade @types/node to 14.18.63

Update dependency @​types/node to v18.19.127

• Schedule: ["at any time"]
• Branch name: renovate/node-18.x-lockfile
• Merge into: main
• Upgrade @types/node to 18.19.127

Update dependency @​types/tabulator-tables to v6.2.11

• Schedule: ["at any time"]
• Branch name: renovate/tabulator-tables-6.x-lockfile
• Merge into: main
• Upgrade @types/tabulator-tables to 6.2.11

Update dependency alabaster to v0.7.16

• Schedule: ["at any time"]
• Branch name: renovate/alabaster-0.x
• Merge into: main
• Upgrade alabaster to ==0.7.16

Update dependency cryptography to v43.0.3

• Schedule: ["at any time"]
• Branch name: renovate/cryptography-43.x
• Merge into: main
• Upgrade cryptography to ==43.0.3

Update dependency deprecated to v1.2.18

• Schedule: ["at any time"]
• Branch name: renovate/deprecated-1.x
• Merge into: main
• Upgrade deprecated to ==1.2.18

Update dependency esbuild to v0.25.10

• Schedule: ["at any time"]
• Branch name: renovate/esbuild-0.x-lockfile
• Merge into: main
• Upgrade esbuild to 0.25.10

Update dependency gitdb to v4.0.12

• Schedule: ["at any time"]
• Branch name: renovate/gitdb-4.x
• Merge into: main
• Upgrade gitdb to ==4.0.12

Update dependency gitpython to v3.1.45

• Schedule: ["at any time"]
• Branch name: renovate/gitpython-3.x
• Merge into: main
• Upgrade gitpython to ==3.1.45

Update dependency jinja2 to v3.1.6

• Schedule: ["at any time"]
• Branch name: renovate/jinja2-3.x
• Merge into: main
• Upgrade jinja2 to ==3.1.6

Update dependency libpfm to v4.11.0.bcr.1

• Schedule: ["at any time"]
• Branch name: renovate/libpfm-4.x
• Merge into: main
• Upgrade libpfm to 4.11.0.bcr.1

Update dependency llvm_zstd to v1.5.7

• Schedule: ["at any time"]
• Branch name: renovate/llvm_zstd-1.x
• Merge into: main
• Upgrade llvm_zstd to v1.5.7

Update dependency markupsafe to v2.1.5

• Schedule: ["at any time"]
• Branch name: renovate/markupsafe-2.x
• Merge into: main
• Upgrade markupsafe to ==2.1.5

Update dependency ml-dtypes to v0.5.3

• Schedule: ["at any time"]
• Branch name: renovate/ml-dtypes-0.x
• Merge into: main
• Upgrade ml-dtypes to ==0.5.3

Update dependency platforms to v0.0.11

• Schedule: ["at any time"]
• Branch name: renovate/platforms-0.x
• Merge into: main
• Upgrade platforms to 0.0.11

Update dependency prettier-plugin-curly to v0.3.2

• Schedule: ["at any time"]
• Branch name: renovate/prettier-plugin-curly-0.x-lockfile
• Merge into: main
• Upgrade prettier-plugin-curly to 0.3.2

Update dependency protobuf to v6.32.1

• Schedule: ["at any time"]
• Branch name: renovate/protobuf-6.x
• Merge into: main
• Upgrade protobuf to ==6.32.1

Update dependency requests to v2.32.5

• Schedule: ["at any time"]
• Branch name: renovate/requests-2.x
• Merge into: main
• Upgrade requests to ==2.32.5

Update dependency smmap to v5.0.2

• Schedule: ["at any time"]
• Branch name: renovate/smmap-5.x
• Merge into: main
• Upgrade smmap to ==5.0.2

Update dependency sphinx-reredirects to v0.1.6

• Schedule: ["at any time"]
• Branch name: renovate/sphinx-reredirects-0.x
• Merge into: main
• Upgrade sphinx-reredirects to ==0.1.6

Update dependency sphinxcontrib-devhelp to v1.0.6

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-devhelp-1.x
• Merge into: main
• Upgrade sphinxcontrib-devhelp to ==1.0.6

Update dependency sphinxcontrib-qthelp to v1.0.8

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-qthelp-1.x
• Merge into: main
• Upgrade sphinxcontrib-qthelp to ==1.0.8

Update dependency sphinxcontrib-serializinghtml to v1.1.10

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-serializinghtml-1.x
• Merge into: main
• Upgrade sphinxcontrib-serializinghtml to ==1.1.10

Update dependency swig to v4.3.1.post0

• Schedule: ["at any time"]
• Branch name: renovate/swig-4.x
• Merge into: main
• Upgrade swig to ==4.3.1.post0

Update hendrikmuhs/ccache-action action to v1.2.19

• Schedule: ["at any time"]
• Branch name: renovate/hendrikmuhs-ccache-action-1.x
• Merge into: main
• Upgrade hendrikmuhs/ccache-action to bfa03e1de4d7f7c3e80ad9109feedd05c4f5a716

Update ossf/scorecard-action action to v2.4.2

• Schedule: ["at any time"]
• Branch name: renovate/ossf-scorecard-action-2.x
• Merge into: main
• Upgrade ossf/scorecard-action to 05b42c624433fc40578a4040d5cf5e36ddca8cde

Update actions/attest-build-provenance action to v1.4.4

• Schedule: ["at any time"]
• Branch name: renovate/actions-attest-build-provenance-1.x
• Merge into: main
• Upgrade actions/attest-build-provenance to ef244123eb79f2f7a7e75d99086184180e6d0018

Update actions/checkout action to v4.3.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-4.x
• Merge into: main
• Upgrade actions/checkout to 08eba0b27e820071cde6df949e0beb9ba4906955

Update actions/github-script action to v7.1.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-github-script-7.x
• Merge into: main
• Upgrade actions/github-script to f28e40c7f34bde8b3046d885e986cb6290c5673b

Update actions/setup-node action to v4.4.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-node-4.x
• Merge into: main
• Upgrade actions/setup-node to 49933ea5288caeca8642d1e84afbd3f7d6820020

Update actions/setup-python action to v5.6.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-python-5.x
• Merge into: main
• Upgrade actions/setup-python to a26af69be951a213d495a4c3e4e4022e16d87065

Update aminya/setup-cpp action to v1.7.1

• Schedule: ["at any time"]
• Branch name: renovate/aminya-setup-cpp-1.x
• Merge into: main
• Upgrade aminya/setup-cpp to a276e6e3d1db9160db5edc458e99a30d3b109949

Update dependency @​types/vscode to v1.104.0

• Schedule: ["at any time"]
• Branch name: renovate/vscode-1.x
• Merge into: main
• Upgrade @types/vscode to ~1.104.0
• Upgrade @types/vscode to 1.104.0

Update dependency @​types/vscode to v1.104.0

• Schedule: ["at any time"]
• Branch name: renovate/vscode-1.x-lockfile
• Merge into: main
• Upgrade @types/vscode to 1.104.0

Update dependency @​vscode/vsce to v2.32.0

• Schedule: ["at any time"]
• Branch name: renovate/vscode-vsce-2.x-lockfile
• Merge into: main
• Upgrade @vscode/vsce to 2.32.0

Update dependency @​vscode/vsce to v3.6.1

• Schedule: ["at any time"]
• Branch name: renovate/vscode-vsce-3.x-lockfile
• Merge into: main
• Upgrade @vscode/vsce to 3.6.1

Update dependency babel to v2.17.0

• Schedule: ["at any time"]
• Branch name: renovate/babel-2.x
• Merge into: main
• Upgrade babel to ==2.17.0

Update dependency bazel to v8.4.1

• Schedule: ["at any time"]
• Branch name: renovate/bazel-8.x
• Merge into: main
• Upgrade bazel to 8.4.1

Update dependency bazel_skylib to v1.8.1

• Schedule: ["at any time"]
• Branch name: renovate/bazel_skylib-1.x
• Merge into: main
• Upgrade bazel_skylib to 1.8.1

Update dependency beautifulsoup4 to v4.13.5

• Schedule: ["at any time"]
• Branch name: renovate/beautifulsoup4-4.x
• Merge into: main
• Upgrade beautifulsoup4 to ==4.13.5

Update dependency build_bazel_apple_support to v1.23.1

• Schedule: ["at any time"]
• Branch name: renovate/build_bazel_apple_support-1.x
• Merge into: main
• Upgrade build_bazel_apple_support to 1.23.1

Update dependency certifi to v2024.12.14

• Schedule: ["at any time"]
• Branch name: renovate/certifi-2024.x
• Merge into: main
• Upgrade certifi to ==2024.12.14

Update dependency charset-normalizer to v3.4.3

• Schedule: ["at any time"]
• Branch name: renovate/charset-normalizer-3.x
• Merge into: main
• Upgrade charset-normalizer to ==3.4.3

Update dependency chokidar to v3.6.0

• Schedule: ["at any time"]
• Branch name: renovate/chokidar-3.x
• Merge into: main
• Upgrade chokidar to 3.6.0

Update dependency com_google_googletest to v1.17.0

• Schedule: ["at any time"]
• Branch name: renovate/com_google_googletest-1.x
• Merge into: main
• Upgrade com_google_googletest to v1.17.0

Update dependency docutils to v0.22.2

• Schedule: ["at any time"]
• Branch name: renovate/docutils-0.x
• Merge into: main
• Upgrade docutils to ==0.22.2

Update dependency furo to v2024.8.6

• Schedule: ["at any time"]
• Branch name: renovate/furo-2024.x
• Merge into: main
• Upgrade furo to ==2024.8.6

Update dependency google-cloud-storage to v3.4.0

• Schedule: ["at any time"]
• Branch name: renovate/google-cloud-storage-3.x
• Merge into: main
• Upgrade google-cloud-storage to ==3.4.0

Update dependency googletest to v1.17.0

• Schedule: ["at any time"]
• Branch name: renovate/googletest-1.x
• Merge into: main
• Upgrade googletest to 1.17.0

Update dependency idna to v3.10

• Schedule: ["at any time"]
• Branch name: renovate/idna-3.x
• Merge into: main
• Upgrade idna to ==3.10

Update dependency llvm_zlib to v2.2.5

• Schedule: ["at any time"]
• Branch name: renovate/llvm_zlib-2.x
• Merge into: main
• Upgrade llvm_zlib to 2.2.5

Update dependency markdown to v3.9

• Schedule: ["at any time"]
• Branch name: renovate/markdown-3.x
• Merge into: main
• Upgrade markdown to ==3.9

Update dependency mdit-py-plugins to v0.5.0

• Schedule: ["at any time"]
• Branch name: renovate/mdit-py-plugins-0.x
• Merge into: main
• Upgrade mdit-py-plugins to ==0.5.0

Update dependency minimatch to v3.1.2

• Schedule: ["at any time"]
• Branch name: renovate/minimatch-3.x-lockfile
• Merge into: main
• Upgrade minimatch to 3.1.2

Update dependency nan to v2.23.0

• Schedule: ["at any time"]
• Branch name: renovate/nan-2.x-lockfile
• Merge into: main
• Upgrade nan to 2.23.0

Update dependency numpy to v1.26.4

• Schedule: ["at any time"]
• Branch name: renovate/numpy-1.x
• Merge into: main
• Upgrade numpy to ==1.26.4

Update dependency prettier to v3.6.2

• Schedule: ["at any time"]
• Branch name: renovate/prettier-3.x-lockfile
• Merge into: main
• Upgrade prettier to 3.6.2

Update dependency psutil to v7.1.0

• Schedule: ["at any time"]
• Branch name: renovate/psutil-7.x
• Merge into: main
• Upgrade psutil to ==7.1.0

Update dependency pybind11 to v2.13.6

• Schedule: ["at any time"]
• Branch name: renovate/pybind11-2.x
• Merge into: main
• Upgrade pybind11 to v2.13.6

Update dependency pycparser to v2.23

• Schedule: ["at any time"]
• Branch name: renovate/pycparser-2.x
• Merge into: main
• Upgrade pycparser to ==2.23

Update dependency pygithub to v2.8.1

• Schedule: ["at any time"]
• Branch name: renovate/pygithub-2.x
• Merge into: main
• Upgrade pygithub to ==2.8.1

Update dependency pygments to v2.19.2

• Schedule: ["at any time"]
• Branch name: renovate/pygments-2.x
• Merge into: main
• Upgrade pygments to ==2.19.2

Update dependency pyjwt to v2.10.1

• Schedule: ["at any time"]
• Branch name: renovate/pyjwt-2.x
• Merge into: main
• Upgrade pyjwt to ==2.10.1

Update dependency pynacl to v1.6.0

• Schedule: ["at any time"]
• Branch name: renovate/pynacl-1.x
• Merge into: main
• Upgrade pynacl to ==1.6.0

Update dependency python to 3.13

• Schedule: ["at any time"]
• Branch name: renovate/python-3.x
• Merge into: main
• Upgrade python to 3.13

Update dependency pyyaml to v5.4.1

• Schedule: ["at any time"]
• Branch name: renovate/pyyaml-5.x
• Merge into: main
• Upgrade pyyaml to 5.4.1

Update dependency robin_map to v1.4.0

• Schedule: ["at any time"]
• Branch name: renovate/robin_map-1.x
• Merge into: main
• Upgrade robin_map to v1.4.0

Update dependency rules_cc to v0.2.8

• Schedule: ["at any time"]
• Branch name: renovate/rules_cc-0.x
• Merge into: main
• Upgrade rules_cc to 0.2.8

Update dependency rules_foreign_cc

• Schedule: ["at any time"]
• Branch name: renovate/rules_foreign_cc-0.x
• Merge into: main
• Upgrade rules_foreign_cc to 0.15.0
• Upgrade rules_foreign_cc to 0.15.1

Update dependency rules_python to v0.40.0

• Schedule: ["at any time"]
• Branch name: renovate/rules_python-0.x
• Merge into: main
• Upgrade rules_python to 0.40.0
• Upgrade rules_python to 0.40.0

Update dependency scipy to v1.16.2

• Schedule: ["at any time"]
• Branch name: renovate/scipy-1.x
• Merge into: main
• Upgrade scipy to ==1.16.2

Update dependency semver to v7.7.2

• Schedule: ["at any time"]
• Branch name: renovate/semver-7.x-lockfile
• Merge into: main
• Upgrade semver to 7.7.2

Update dependency soupsieve to v2.8

• Schedule: ["at any time"]
• Branch name: renovate/soupsieve-2.x
• Merge into: main
• Upgrade soupsieve to ==2.8

Update dependency sphinx to v7.4.7

• Schedule: ["at any time"]
• Branch name: renovate/sphinx-7.x
• Merge into: main
• Upgrade sphinx to ==7.4.7

Update dependency sphinx-automodapi to v0.20.0

• Schedule: ["at any time"]
• Branch name: renovate/sphinx-automodapi-0.x
• Merge into: main
• Upgrade sphinx-automodapi to ==0.20.0

Update dependency sphinxcontrib-htmlhelp to v2.1.0

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-htmlhelp-2.x
• Merge into: main
• Upgrade sphinxcontrib-htmlhelp to ==2.1.0

Update dependency tree-sitter-cli to ^0.25.0

• Schedule: ["at any time"]
• Branch name: renovate/tree-sitter-cli-0.x
• Merge into: main
• Upgrade tree-sitter-cli to ^0.25.0

Update dependency typescript to v4.9.5

• Schedule: ["at any time"]
• Branch name: renovate/typescript-4.x-lockfile
• Merge into: main
• Upgrade typescript to 4.9.5

Update dependency typescript to v5.9.2

• Schedule: ["at any time"]
• Branch name: renovate/typescript-5.x-lockfile
• Merge into: main
• Upgrade typescript to 5.9.2

Update dependency typing-extensions to v4.15.0

• Schedule: ["at any time"]
• Branch name: renovate/typing-extensions-4.x
• Merge into: main
• Upgrade typing-extensions to ==4.15.0

Update dependency urllib3 to v2.5.0

• Schedule: ["at any time"]
• Branch name: renovate/urllib3-2.x
• Merge into: main
• Upgrade urllib3 to ==2.5.0

Update dependency vscode-languageclient to v8.1.0

• Schedule: ["at any time"]
• Branch name: renovate/vscode-languageclient-8.x-lockfile
• Merge into: main
• Upgrade vscode-languageclient to 8.1.0

Update dependency wrapt to v1.17.3

• Schedule: ["at any time"]
• Branch name: renovate/wrapt-1.x
• Merge into: main
• Upgrade wrapt to ==1.17.3

Update docker.io/python Docker tag to v3.13

• Schedule: ["at any time"]
• Branch name: renovate/docker.io-python-3.x
• Merge into: main
• Upgrade docker.io/python to 3.13

Update docker/login-action action to v3.5.0

• Schedule: ["at any time"]
• Branch name: renovate/docker-login-action-3.x
• Merge into: main
• Upgrade docker/login-action to 184bdaa0721073962dff0199f1fb9940f07167d1

Update github/codeql-action action to v2.28.1

• Schedule: ["at any time"]
• Branch name: renovate/github-codeql-action-2.x
• Merge into: main
• Upgrade github/codeql-action to b8d3b6e8af63cde30bdc382c0bc28114f4346c88

Update nvidia/cuda Docker tag to v12.9.1

• Schedule: ["at any time"]
• Branch name: renovate/nvidia-cuda-12.x
• Merge into: main
• Upgrade nvidia/cuda to 12.9.1-devel-ubuntu24.04

Update pypa/gh-action-pypi-publish action to v1.13.0

• Schedule: ["at any time"]
• Branch name: renovate/pypa-gh-action-pypi-publish-1.x
• Merge into: main
• Upgrade pypa/gh-action-pypi-publish to ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e

Update actions/attest-build-provenance action to v3

• Schedule: ["at any time"]
• Branch name: renovate/actions-attest-build-provenance-3.x
• Merge into: main
• Upgrade actions/attest-build-provenance to 977bb373ede98d70efdf65b84cb5f73e068dcc2a

Update actions/checkout action to v5

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-5.x
• Merge into: main
• Upgrade actions/checkout to 08c6903cd8c0fde910a37f88322edcfb5dd907a8

Update actions/github-script action to v8

• Schedule: ["at any time"]
• Branch name: renovate/actions-github-script-8.x
• Merge into: main
• Upgrade actions/github-script to ed597411d8f924073f98dfc5c65a23a2325f34cd

Update actions/labeler action to v6

• Schedule: ["at any time"]
• Branch name: renovate/actions-labeler-6.x
• Merge into: main
• Upgrade actions/labeler to 634933edcd8ababfe52f92936142cc22ac488b1b

Update actions/setup-node action to v5

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-node-5.x
• Merge into: main
• Upgrade actions/setup-node to a0853c24544627f65ddf259abe73b1d18a591444

Update actions/setup-python action to v6

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-python-6.x
• Merge into: main
• Upgrade actions/setup-python to e797f83bcb11b83ae66e0230d6156d7c80228e7c

Update debian Docker tag to v13

• Schedule: ["at any time"]
• Branch name: renovate/debian-13.x
• Merge into: main
• Upgrade debian to 13

Update dependency @​types/mocha to v10

• Schedule: ["at any time"]
• Branch name: renovate/mocha-10.x
• Merge into: main
• Upgrade @types/mocha to ^10.0.0

Update dependency @​vscode/vsce to v3

• Schedule: ["at any time"]
• Branch name: renovate/vscode-vsce-3.x
• Merge into: main
• Upgrade @vscode/vsce to ^3.0.0

Update dependency alabaster to v1

• Schedule: ["at any time"]
• Branch name: renovate/alabaster-1.x
• Merge into: main
• Upgrade alabaster to ==1.0.0

Update dependency cachetools to v6

• Schedule: ["at any time"]
• Branch name: renovate/cachetools-6.x
• Merge into: main
• Upgrade cachetools to ==6.2.0

Update dependency certifi to v2025

• Schedule: ["at any time"]
• Branch name: renovate/certifi-2025.x
• Merge into: main
• Upgrade certifi to ==2025.8.3

Update dependency cffi to v2

• Schedule: ["at any time"]
• Branch name: renovate/cffi-2.x
• Merge into: main
• Upgrade cffi to ==2.0.0

Update dependency chokidar to v4

• Schedule: ["at any time"]
• Branch name: renovate/chokidar-4.x
• Merge into: main
• Upgrade chokidar to 4.0.3

Update dependency cryptography to v46

• Schedule: ["at any time"]
• Branch name: renovate/cryptography-46.x
• Merge into: main
• Upgrade cryptography to ==46.0.1

Update dependency furo to v2025

• Schedule: ["at any time"]
• Branch name: renovate/furo-2025.x
• Merge into: main
• Upgrade furo to ==2025.7.19

Update dependency glob to v11

• Schedule: ["at any time"]
• Branch name: renovate/glob-11.x
• Merge into: main
• Upgrade glob to ^11.0.0

Update dependency js-yaml to v4

• Schedule: ["at any time"]
• Branch name: renovate/js-yaml-4.x
• Merge into: main
• Upgrade js-yaml to ^4.0.0

Update dependency junitparser to v4

• Schedule: ["at any time"]
• Branch name: renovate/junitparser-4.x
• Merge into: main
• Upgrade junitparser to ==4.0.2

Update dependency markdown-it-py to v4

• Schedule: ["at any time"]
• Branch name: renovate/markdown-it-py-4.x
• Merge into: main
• Upgrade markdown-it-py to ==4.0.0

Update dependency markupsafe to v3

• Schedule: ["at any time"]
• Branch name: renovate/markupsafe-3.x
• Merge into: main
• Upgrade markupsafe to ==3.0.2

Update dependency minimatch to v10

• Schedule: ["at any time"]
• Branch name: renovate/minimatch-10.x
• Merge into: main
• Upgrade minimatch to ^10.0.0

Update dependency myst-parser to v4

• Schedule: ["at any time"]
• Branch name: renovate/myst-parser-4.x
• Merge into: main
• Upgrade myst-parser to ==4.0.1

Update dependency node to v22

• Schedule: ["at any time"]
• Branch name: renovate/node-22.x
• Merge into: main
• Upgrade node to 22
• Upgrade @types/node to ^22.0.0

Update dependency numpy to v2.3.3

• Schedule: ["at any time"]
• Branch name: renovate/numpy-2.x
• Merge into: main
• Upgrade numpy to ==2.3.3
• Upgrade numpy to >=2.3.3, <=2.3.3

Update dependency packaging to v25

• Schedule: ["at any time"]
• Branch name: renovate/packaging-25.x
• Merge into: main
• Upgrade packaging to ==25.0

Update dependency platforms to v1

• Schedule: ["at any time"]
• Branch name: renovate/platforms-1.x
• Merge into: main
• Upgrade platforms to 1.0.0

Update dependency pybind11 to v3

• Schedule: ["at any time"]
• Branch name: renovate/pybind11-3.x
• Merge into: main
• Upgrade pybind11 to >=3.0.1, <=3.0.1
• Upgrade pybind11 to ==3.0.1
• Upgrade pybind11 to v3.0.1

Update dependency PyYAML to >=6.0.2, <=6.0.2

• Schedule: ["at any time"]
• Branch name: renovate/pyyaml-6.x
• Merge into: main
• Upgrade PyYAML to >=6.0.2, <=6.0.2
• Upgrade pyyaml to ==6.0.2
• Upgrade pyyaml to 6.0.2

Update dependency rules_python to v1.6.3

• Schedule: ["at any time"]
• Branch name: renovate/rules_python-1.x
• Merge into: main
• Upgrade rules_python to 1.6.3
• Upgrade rules_python to 1.6.3

Update dependency snowballstemmer to v3

• Schedule: ["at any time"]
• Branch name: renovate/snowballstemmer-3.x
• Merge into: main
• Upgrade snowballstemmer to ==3.0.1

Update dependency sphinx to v8

• Schedule: ["at any time"]
• Branch name: renovate/sphinx-8.x
• Merge into: main
• Upgrade sphinx to ==8.2.3

Update dependency sphinx-reredirects to v1

• Schedule: ["at any time"]
• Branch name: renovate/sphinx-reredirects-1.x
• Merge into: main
• Upgrade sphinx-reredirects to ==1.0.0

Update dependency sphinxcontrib-applehelp to v2

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-applehelp-2.x
• Merge into: main
• Upgrade sphinxcontrib-applehelp to ==2.0.0

Update dependency sphinxcontrib-devhelp to v2

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-devhelp-2.x
• Merge into: main
• Upgrade sphinxcontrib-devhelp to ==2.0.0

Update dependency sphinxcontrib-qthelp to v2

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-qthelp-2.x
• Merge into: main
• Upgrade sphinxcontrib-qthelp to ==2.0.0

Update dependency sphinxcontrib-serializinghtml to v2

• Schedule: ["at any time"]
• Branch name: renovate/sphinxcontrib-serializinghtml-2.x
• Merge into: main
• Upgrade sphinxcontrib-serializinghtml to ==2.0.0

Update dependency tslint to v6

• Schedule: ["at any time"]
• Branch name: renovate/tslint-6.x
• Merge into: main
• Upgrade tslint to ^6.0.0

Update dependency typescript to v5

• Schedule: ["at any time"]
• Branch name: renovate/typescript-5.x
• Merge into: main
• Upgrade typescript to ^5.0.0

Update dependency vscode-languageclient to v9

• Schedule: ["at any time"]
• Branch name: renovate/vscode-languageclient-9.x
• Merge into: main
• Upgrade vscode-languageclient to ^9.0.0

Update dependency windows to v2025

• Schedule: ["at any time"]
• Branch name: renovate/windows-2025.x
• Merge into: main
• Upgrade windows to 2025

Update github/codeql-action action to v3

• Schedule: ["at any time"]
• Branch name: renovate/github-codeql-action-3.x
• Merge into: main
• Upgrade github/codeql-action to 192325c86100d080feab897ff886c34abd4c83a3

Update nvidia/cuda Docker tag to v13

• Schedule: ["at any time"]
• Branch name: renovate/nvidia-cuda-13.x
• Merge into: main
• Upgrade nvidia/cuda to 13.0.1-devel-ubuntu24.04

Update tj-actions/changed-files action to v47

• Schedule: ["at any time"]
• Branch name: renovate/tj-actions-changed-files-47.x
• Merge into: main
• Upgrade tj-actions/changed-files to 24d32ffd492484c1d75e0c0b894501ddb9d30d62

Update ubuntu Docker tag to v24

• Schedule: ["at any time"]
• Branch name: renovate/ubuntu-24.x
• Merge into: main
• Upgrade ubuntu to noble
• Upgrade ubuntu to 24.04

🚸 Branch creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prhourlylimit for details.

---

Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

• Could not determine new digest for update (github-tags package actions/upload-artifact)
• Could not determine new digest for update (github-tags package github/codeql-action)

Files affected: .github/workflows/libclang-abi-tests.yml, .github/workflows/llvm-tests.yml, .github/workflows/release-documentation.yml, .github/workflows/scorecard.yml

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Thank you for submitting a Pull Request (PR) to the LLVM Project!

This PR will be automatically labeled and the relevant teams will be notified.

If you wish to, you can add reviewers by using the "Reviewers" section on this page.

If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using @ followed by their GitHub username.

If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers.

If you have further questions, they may be answered by the LLVM GitHub User Guide.

You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums.

[boomanaiden154]

This has been intentionally added. Will finish up the configuration soon so that it only touches Github actions. No one else will be impacted by this.

[boomanaiden154]

Alright, I think this is ready for review. I've set this up to only look at Github Actions and create a PR once a week with version updates. The PR will assign to me for now while I iron out config changes, but we can update later if more people want to get pinged.

[boomanaiden154]

I've also set a 3 day "bake period" which should prevent autoupgrading to a malicious version. That's one learning from the tj-actions/changed-files supply chain issue that I wanted to make sure to take into account.

[nikic]

@boomanaiden154 It looks like you need to file your own PR for that, as renovate-bot is overwriting this one.

[boomanaiden154]

It looks like you need to file your own PR for that, as renovate-bot is overwriting this one.

Yeah, not sure why it's doing that. We need to merge this PR though in order to enable it. I've manually updated everything for now with the config that I've confirmed as working and will keep an eye on things to make sure nothing goes haywire.

[github-actions]

@renovate-bot Congratulations on having your first Pull Request (PR) merged into the LLVM Project!

Your changes will be combined with recent changes from other authors, then tested by our build bots. If there is a problem with a build, you may receive a report in an email or a comment on this PR.

Please check whether problems have been caused by your change specifically, as the builds can include changes from many authors. It is not uncommon for your change to be included in a build that fails due to someone else's changes, or infrastructure issues.

How to do this, and the rest of the post-merge process, is covered in detail here.

If your change does cause a problem, it may be reverted, or you can revert it yourself. This is a normal part of LLVM development. You can fix your changes and open a new PR to merge them again.

If you don't get any reports, no action is required from you. Your changes are working as expected, well done!