ci(lint): cache dprint plugins and pin plugin integrity checksum

.github/workflows/lint.yml

@@ -126,6 +126,14 @@ jobs:
           install_args: "dprint"
           version: ${{ inputs.mise-version }}
 
+      - name: Cache dprint plugins
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/dprint
+          key: dprint-${{ runner.os }}-${{ hashFiles('**/dprint.json', '**/.dprint.json', '**/dprint.jsonc', '**/.dprint.jsonc') }}
+          restore-keys: |
+            dprint-${{ runner.os }}-
+
       - name: Check formatting with dprint
         env:
           CONFIG_DIR: ${{ inputs.lint-config-dir }}

.renovate/customManagers.json5

@@ -70,5 +70,20 @@
       depNameTemplate: "DevSecNinja/dotfiles",
       datasourceTemplate: "github-releases",
     },
+    {
+      // Track dprint WASM plugin versions in dprint config files. The plugin
+      // URL is pinned with an integrity checksum (…wasm@<sha256>); Renovate can
+      // bump the version but cannot recompute the checksum, so a plugin update
+      // PR will fail the dprint check until the hash is refreshed with
+      // `dprint config update`. That red check is the intended signal.
+      customType: "regex",
+      description: "Update dprint WASM plugin versions in dprint config files",
+      managerFilePatterns: ["/(^|/)\\.?dprint\\.jsonc?$/"],
+      matchStrings: [
+        "https://plugins\\.dprint\\.dev/(?<depName>[a-z0-9-]+?)-(?<currentValue>\\d+\\.\\d+\\.\\d+)\\.wasm",
+      ],
+      depNameTemplate: "dprint/dprint-plugin-{{{depName}}}",
+      datasourceTemplate: "github-releases",
+    },
   ],
 }

config-sync/files/dprint.json

@@ -3,6 +3,6 @@
   "includes": ["**/*.md"],
   "excludes": ["**/node_modules", "**/CHANGELOG.md", "**/release-notes.md"],
   "plugins": [
-    "https://plugins.dprint.dev/markdown-0.21.1.wasm"
+    "https://plugins.dprint.dev/markdown-0.21.1.wasm@064467750514c9ce5192b375582d762ec64cb3ba99673413fa86645d50406279"
   ]
 }