From 85535c6875f0c3bd150cc077f5ded93d445c48d8 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 21:30:08 +0000
Subject: [PATCH 1/2] =?UTF-8?q?chore(container):=20update=20image=20ghcr.i?=
 =?UTF-8?q?o/devsecninja/dotfiles-devcontainer=20(=20a411d3a=20=E2=9E=94?=
 =?UTF-8?q?=2097be4de=20)=20[automerge]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .devcontainer/devcontainer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index eae4f26d..449d96e6 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -6,7 +6,7 @@
   // fresh, correctly detecting the runtime environment (CI, Codespaces, etc.)
   // Pinned by digest only (no tag): the devcontainers CLI cannot parse a
   // combined `:tag@sha256:...` reference, so Renovate keeps just the digest.
-  "image": "ghcr.io/devsecninja/dotfiles-devcontainer@sha256:a411d3a8b2b924dda8e498e3af7c833e63adccfce67dba8f0a3fb8e13980b3fe",
+  "image": "ghcr.io/devsecninja/dotfiles-devcontainer@sha256:97be4de68122c9d5f710dd056e5c1d11d4cf8d6766d7860329c6d8fc2cd5c49b",
   "features": {
     "ghcr.io/devcontainers/features/git-lfs:1": {
       "version": "latest"

From 09f4d946e51545b87db4725332367e7b65e533dd Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 21:30:45 +0000
Subject: [PATCH 2/2] =?UTF-8?q?ci(github-tag):=20Update=20tag=20DevSecNinj?=
 =?UTF-8?q?a/.github=20(=20v1.9.0=20=E2=9E=94=20v2.2.0=20)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .devcontainer/devcontainer.json      | 2 +-
 .github/workflows/config-sync.yml    | 2 +-
 .github/workflows/release-please.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 449d96e6..eae4f26d 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -6,7 +6,7 @@
   // fresh, correctly detecting the runtime environment (CI, Codespaces, etc.)
   // Pinned by digest only (no tag): the devcontainers CLI cannot parse a
   // combined `:tag@sha256:...` reference, so Renovate keeps just the digest.
-  "image": "ghcr.io/devsecninja/dotfiles-devcontainer@sha256:97be4de68122c9d5f710dd056e5c1d11d4cf8d6766d7860329c6d8fc2cd5c49b",
+  "image": "ghcr.io/devsecninja/dotfiles-devcontainer@sha256:a411d3a8b2b924dda8e498e3af7c833e63adccfce67dba8f0a3fb8e13980b3fe",
   "features": {
     "ghcr.io/devcontainers/features/git-lfs:1": {
       "version": "latest"
diff --git a/.github/workflows/config-sync.yml b/.github/workflows/config-sync.yml
index a972ed50..10e26cba 100644
--- a/.github/workflows/config-sync.yml
+++ b/.github/workflows/config-sync.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   sync:
-    uses: DevSecNinja/.github/.github/workflows/config-sync.yml@27fd66740c629ea38380dcd3bf93e7bc74c54247 # v1.9.0
+    uses: DevSecNinja/.github/.github/workflows/config-sync.yml@783a7a3a03ae71efcdf5b13eaea80efe26dfa641 # v2.2.0
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index b8caf7ce..a258bacf 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -34,7 +34,7 @@ concurrency:
 jobs:
   release-please:
     # renovate: datasource=github-tags depName=DevSecNinja/.github
-    uses: DevSecNinja/.github/.github/workflows/release-please.yml@27fd66740c629ea38380dcd3bf93e7bc74c54247 # v1.9.0
+    uses: DevSecNinja/.github/.github/workflows/release-please.yml@783a7a3a03ae71efcdf5b13eaea80efe26dfa641 # v2.2.0
     permissions:
       contents: write
       pull-requests: write