The release-please onboarding guide told callers to add a # renovate: datasource=github-tags depName=DevSecNinja/.github annotation above the reusable-workflow uses: line. That annotation is redundant — Renovate's github-actions manager tracks reusable-workflow and action callers natively via the # vX.Y.Z version comment — and Renovate strips it on the next bump, which broke CI in DevSecNinja/wazzup#166.

A follow-up audit confirmed that # renovate: comments on uses: lines are inert in this repo: no custom manager in .renovate/customManagers.json5 and no test consumes them, so they were no-ops handled natively by the github-actions manager. The same redundant annotations were removed from the repo's own workflows.

Changes

• docs/release-please-onboarding.md: removed the # renovate: line from the release-please.yml caller example and reworded the explanation to state the # vX.Y.Z comment is sufficient; native tracking bumps both the SHA and the comment, so no separate annotation is needed.
• .github/workflows/config-sync.yml, vendored-file-sync.yml, release-please-caller.yml, release-please.yml: removed the inert # renovate: annotations sitting on uses: lines (actions/open-pr, the release-please self-reference, create-github-app-token, release-please-action).

The guide now matches the repo's own workflow-templates/* (which already omit the annotation) and docs/architecture.md (which only annotates with: version inputs). Annotations that feed the version: custom regex manager — with: mise-version / golangci-lint-version, the mise version: in test.yml, composite-action version: defaults, .mise.toml min_version, and the SOPS pin in scripts/dccd.sh — are intentionally kept, as the comment is their required datasource/depName input. The with:-input annotation convention from ADR 0001 is unchanged.

jobs:
  release-please:
    # before: # renovate: datasource=github-tags depName=DevSecNinja/.github  ← removed
    uses: DevSecNinja/.github/.github/workflows/release-please.yml@<sha> # vX.Y.Z