[renovate]

This PR contains the following updates:

Package	Type	Update	Change
husterk/.github		minor	v2.0.0 → v2.1.2
husterk/.github	action	minor	v2.0.0 → v2.1.2

---

Release Notes

husterk/.github (husterk/.github)

v2.1.2

Compare Source

• renovate/mise points aqua:1password/cli at the 1Password CLI datasource. The hosted Renovate app locks mise tools in safe mode, which can't install the vfox plugin behind op, so repositories pin the CLI through mise's built-in aqua backend instead.

v2.1.1

Compare Source

• The repository guides add a rule for secrets several repos share: a shared vault is for people and local tooling only, and a repo's automation gets its own credential from the provider instead of reading the shared vault.

v2.1.0

Compare Source

• The public and private repository guides describe one CI access model:
  • OP_SERVICE_ACCOUNT_TOKEN is the only GitHub secret, kept in a deploy environment limited to main;
  • one read-only 1Password service account per repo and purpose, with its token item stored outside every vault a service account can read;
  • a separate preview environment and account for PR previews;
  • a per-repo tag:ci-<repo> for workflows that join the tailnet.
• The Cloudflare sites guide drops the exception that let Workers previews share the deploy token. Previews get their own account and a token with no zone permission.
• scripts/audit-repo.sh reports FAIL for any repository secret, where it used to print INFO. An environment without a deployment branch policy is expected only when it is named preview.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.