fix: include workflow-templates in release auto-pin updates

[marcusrbrown]

Summary

Adds workflow-templates/ to the release script's auto-pin mappings, closing the recursive release loop seen in PR #1825.

The cycle: root package released → Renovate updates workflow-templates/*.yaml SHA pins → generates @bfra.me/.github patch changeset → triggers another release → repeat.

Fix

Added @bfra.me/.github to WORKFLOW_PIN_MAPPINGS with three workflow template files:

File	Pattern
workflow-templates/renovate-changesets.yaml	renovate-changeset.yaml@SHA # vVERSION
workflow-templates/renovate.yaml	renovate.yaml@SHA # vVERSION
workflow-templates/update-repo-settings.yaml	update-repo-settings.yaml@SHA # vVERSION

Uses versionPrefix: 'v' since workflow templates use v4.13.0 format (vs 0.2.26 for actions).

Now when any release runs, the auto-pin PR includes ALL internal references — both the action workflow files AND the workflow templates.

[fro-bot]

Verdict: PASS

Blocking issues

None

Non-blocking concerns

None

Missing tests

No tests exist for scripts/release.ts. The file is a release orchestration script with complex git/GitHub API interactions that would benefit from unit tests, particularly for the updateInternalWorkflowPins regex matching logic. Adding tests would help catch issues like pattern drift in future changes. However, this is pre-existing and not introduced by this PR.

Risk assessment: LOW

Rationale:

This is a well-scoped, targeted fix that adds workflow-templates to the existing auto-pin mechanism. The changes correctly address the recursive release loop described in PR #1825.

Code Review:

1. Pattern correctness verified: The regex patterns correctly match the uses: lines in the three workflow templates:

   • renovate-changesets.yaml → matches renovate-changeset.yaml workflow reference
   • renovate.yaml → matches renovate.yaml workflow reference
   • update-repo-settings.yaml → matches update-repo-settings.yaml workflow reference

2. Version prefix is correct: The root package @bfra.me/.github uses semver versioning (e.g., 4.13.1), and workflow templates prefix with v (e.g., # v4.13.0). The versionPrefix: 'v' correctly produces the expected format.

3. Mapping structure follows existing patterns: The new mapping entry follows the same WorkflowPinMapping interface used by existing mappings for renovate-changesets and update-repository-settings actions.

4. TypeScript type-check passes: No type errors introduced.

5. Logic integration: The updateInternalWorkflowPins function already iterates over all WORKFLOW_PIN_MAPPINGS entries, so the new mapping will automatically be included in the release pinning workflow without additional changes.

Verified in templates:

# workflow-templates/renovate-changesets.yaml:17
uses: bfra-me/.github/.github/workflows/renovate-changeset.yaml@d36ffbc... # v4.13.0

# workflow-templates/renovate.yaml:46
uses: bfra-me/.github/.github/workflows/renovate.yaml@d36ffbc... # v4.13.0

# workflow-templates/update-repo-settings.yaml:16
uses: bfra-me/.github/.github/workflows/update-repo-settings.yaml@d36ffbc... # v4.13.0

All patterns match the actual uses: lines with SHA pins and version comments.

---

Run Summary

Field	Value
Event	pull_request
Repository	bfra-me/.github
Run ID	23293520050
Cache	hit
Session	ses_2fa0fb445ffekXDymIVJKOxDsp