ci: release branches for security updates only (#5584)

Signed-off-by: RB <7775707+nitrocode@users.noreply.github.com>
Signed-off-by: Rui Chen <rui@chenrui.dev>
Co-authored-by: Rui Chen <rui@chenrui.dev>

.github/renovate.json5

@@ -31,6 +31,17 @@
     ],
   },
   packageRules: [
+    // enable release branches for security updates
+    {
+      matchBaseBranches: ['/^release-.*/'],
+      matchUpdateTypes: ['security'],
+      enabled: true
+    },
+    // disable release branches for anything else
+    {
+      matchBaseBranches: ['/^release-.*/'],
+      enabled: false
+    },
     {
       matchBaseBranches: [
         'main',

.github/workflows/renovate-config.yml

@@ -26,4 +26,4 @@ jobs:
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
-      - run: npx --package renovate -c 'renovate-config-validator'
+      - run: npx --package=renovate@latest -c renovate-config-validator