docs(renovate): drop redundant uses-line annotations in onboarding guide and workflows

[Copilot]

The release-please onboarding guide told callers to add a # renovate: datasource=github-tags depName=DevSecNinja/.github annotation above the reusable-workflow uses: line. That annotation is redundant — Renovate's github-actions manager tracks reusable-workflow and action callers natively via the # vX.Y.Z version comment — and Renovate strips it on the next bump, which broke CI in DevSecNinja/wazzup#166.

A follow-up audit confirmed that # renovate: comments on uses: lines are inert in this repo: no custom manager in .renovate/customManagers.json5 and no test consumes them, so they were no-ops handled natively by the github-actions manager. The same redundant annotations were removed from the repo's own workflows.

Changes

• docs/release-please-onboarding.md: removed the # renovate: line from the release-please.yml caller example and reworded the explanation to state the # vX.Y.Z comment is sufficient; native tracking bumps both the SHA and the comment, so no separate annotation is needed.
• .github/workflows/config-sync.yml, vendored-file-sync.yml, release-please-caller.yml, release-please.yml: removed the inert # renovate: annotations sitting on uses: lines (actions/open-pr, the release-please self-reference, create-github-app-token, release-please-action).

The guide now matches the repo's own workflow-templates/* (which already omit the annotation) and docs/architecture.md (which only annotates with: version inputs). Annotations that feed the version: custom regex manager — with: mise-version / golangci-lint-version, the mise version: in test.yml, composite-action version: defaults, .mise.toml min_version, and the SOPS pin in scripts/dccd.sh — are intentionally kept, as the comment is their required datasource/depName input. The with:-input annotation convention from ADR 0001 is unchanged.

jobs:
  release-please:
    # before: # renovate: datasource=github-tags depName=DevSecNinja/.github  ← removed
    uses: DevSecNinja/.github/.github/workflows/release-please.yml@<sha> # vX.Y.Z

[DevSecNinja]

@copilot good, are there any other annotations that we now manually set that we can centrally manage in the Renovate config in this repo?

[Copilot]

@copilot good, are there any other annotations that we now manually set that we can centrally manage in the Renovate config in this repo?

Yes — I audited every # renovate: annotation in the repo. There are two distinct kinds:

Inert annotations on uses: lines (removed in the latest commit). No custom manager in .renovate/customManagers.json5 and no test consume # renovate: comments above a uses: line, and Renovate's built-in github-actions manager already tracks those refs natively via the @<sha> # vX.Y.Z pin. So the comments were no-ops. Removed from:

• config-sync.yml + vendored-file-sync.yml (actions/open-pr)
• release-please-caller.yml (self-reference)
• release-please.yml (create-github-app-token, release-please-action)

Annotations that must stay — they're the input to the version: custom regex manager, so they can't be centralized away: with: mise-version / golangci-lint-version (lint-caller, autofix-caller), the mise version: in test.yml, the composite-action version: defaults in actions/*/action.yml, .mise.toml min_version, and the SOPS pin in scripts/dccd.sh. These already rely on the central managers in .renovate/customManagers.json5; the per-file comment is the required datasource/depName, not a duplicate.

Net: nothing else to centralize — just the inert uses:-line comments, now gone.