Summary

Removes the configurationFile: .github/renovate.json5 input that PR #6 had re-added. It was causing every .settings.yaml annotation to be extracted twice in production runs.

Confirmed in production

Run 25346453345 — the first run that completed successfully (PRs #8–#11 created) — also showed:

"regex": {"fileCount": 4, "depCount": 56}

Expected fileCount: 2, depCount: 28. We have two customManagers (broad regex + git-refs digest) targeting one file (.settings.yaml); the doubling means each is loaded twice. With configurationFile: set, the action mounts the file as Renovate's global config, and Renovate independently auto-discovers the same file from the cloned working tree as the repo config. Both loads register the same customManagers, and Renovate does NOT dedupe — every annotation gets two extraction passes.

The 14 Cannot find replaceString in current file content. Was it already updated? warnings the user spotted in the same log are the downstream symptom: pass 1 applies a replacement, pass 2 tries the same replacement but the file content no longer matches.

How we got here

1. PR feat(ci): add self-hosted renovate alongside dependabot #1 — original config, no configurationFile:, customManagers worked correctly.
2. PR fix(ci): drop actions/checkout from renovate workflow #5/fix(ci): restore actions/checkout + configurationFile to renovate workflow #6 — chased persistent repository-changed aborts under the wrong hypothesis. PR fix(ci): restore actions/checkout + configurationFile to renovate workflow #6 re-added configurationFile: to mirror gpu-operator's setup.
3. PR fix(ci): grant statuses:write so renovate can set branch status checks #7 — found the actual cause of the aborts: missing statuses: write permission. Fixed.
4. With fix(ci): grant statuses:write so renovate can set branch status checks #7 in place, configurationFile: is no longer pretending to be load-bearing — it can be dropped.

The RENOVATE_PLATFORM=local dry-runs I did way back in PR #1 had already shown this doubling. I dismissed it as a local-mode artifact; production proved otherwise.

Fixes: doubled customManager extraction + replaceString warnings
Related: #1, #6, #7

Type of Change

• Bug fix
• Build/CI/tooling

Implementation Notes

• One line removed from with: block; comment block above replaced with the production evidence + lesson learned (so future PRs don't re-add it).
• actions/checkout stays — never proven harmful, matches gpu-operator's upstream shape.
• renovate-version digest pin stays.

Testing

actionlint .github/workflows/renovate.yaml   # clean

Post-merge validation:

1. Close the four PRs (chore(deps): Update build-tools - abandoned #8–chore(deps): Update docs - abandoned #11) Renovate created in the doubled-extraction state — the diffs may have inconsistencies from the second pass that didn't take effect.
2. Delete the corresponding orphan branches.
3. Single dispatch.
4. Expected: regex manager stats show fileCount: 2, depCount: 28 instead of 4/56. PRs reopen with clean (single-extraction) diffs. No Cannot find replaceString warnings.

Risk Assessment

• Low — Removes an input that's actively causing duplicate work. Worst case: doubling not entirely fixed (different cause) and we iterate.

Checklist

• Linter passes (actionlint)
• I did not skip/disable tests to make CI green
• Commits are cryptographically signed (git commit -S)