chore(deps): renovate: paddyroddy/.github (minor)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
paddyroddy/.github	repository	minor	v0.377.0 → v0.394.0
paddyroddy/.github (changelog)	action	digest	d8081a8 → 0a54f96

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

paddyroddy/.github (paddyroddy/.github)

v0.394.0

Compare Source

v0.393.0

Compare Source

v0.392.0

Compare Source

v0.391.0

Compare Source

v0.390.0

Compare Source

v0.389.0

Compare Source

v0.388.0

Compare Source

v0.387.0

Compare Source

v0.386.0

Compare Source

v0.385.0

Compare Source

v0.384.0

Compare Source

v0.383.0

Compare Source

v0.382.0

Compare Source

v0.381.0

Compare Source

v0.380.0

Compare Source

v0.379.0

Compare Source

v0.378.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[Copilot]

Pull request overview

Updates the pinned paddyroddy/.github tooling used by pre-commit and GitHub Actions workflows, along with tightening workflow/job permissions.

Changes:

• Bump paddyroddy/.github in .pre-commit-config.yaml from v0.377.0 to v0.394.0.
• Update workflow actions to the new pinned digest (d8081a8 → 0a54f96) and add explicit permissions blocks.
• Adjust the “add-to-project” workflow trigger and token permission configuration.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.pre-commit-config.yaml	Updates the shared pre-commit hook repo version.
.github/workflows/linting.yaml	Pins updated linting action digest and adds contents: read permissions.
.github/workflows/links.yaml	Pins updated links action digest and adds contents: read permissions.
.github/workflows/deploy.yaml	Pins updated deploy-related action digests, adds per-job contents: read, and adds linter/security-tool ignore annotations around secrets.
.github/workflows/add-to-project.yaml	Pins updated action digest, changes event trigger to pull_request, and sets permissions: {} while passing PAT via with.

Comments suppressed due to low confidence (1)

.github/workflows/add-to-project.yaml:22

• # yamllint disable rule:line-length disables the rule for the remainder of the file, but it is never re-enabled here. Prefer yamllint disable-line on the long line(s), or add a matching yamllint enable rule:line-length after the secret input to keep the suppression scoped.

          # yamllint disable rule:line-length
          project-token: ${{ secrets.PROJECT_PAT }} # zizmor: ignore[secrets-outside-env]

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.