chore(deps): update trufflehog to v3.94.3

.github/workflows/renovate-regen.yml

@@ -0,0 +1,80 @@
+name: Regenerate install scripts on Renovate PRs
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "config/*.binstaller.yml"
+
+jobs:
+  regen:
+    if: startsWith(github.head_ref, 'renovate/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install task
+        run: |
+          curl -sSL https://raw.githubusercontent.com/jswank/install/main/scripts/task-install.sh | bash
+          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Install binst
+        run: |
+          curl -sSL https://raw.githubusercontent.com/jswank/install/main/scripts/binstaller-install.sh | bash
+          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Detect changed configs
+        id: changed
+        run: |
+          changed=$(git diff --name-only origin/main...HEAD -- 'config/*.binstaller.yml' \
+            | sed 's|config/||;s|\.binstaller\.yml||' \
+            | tr '\n' ' ')
+          echo "binaries=${changed}" >> "$GITHUB_OUTPUT"
+
+      - name: Extract new versions from changed configs
+        id: versions
+        run: |
+          for binary in ${{ steps.changed.outputs.binaries }}; do
+            version=$(grep -oP '(?<=embedded_checksums:\n\s{4})(v[\d.]+)' \
+              "config/${binary}.binstaller.yml" || \
+              grep -A 1 'embedded_checksums:' "config/${binary}.binstaller.yml" \
+              | tail -1 | grep -oP 'v[\d.]+')
+            echo "${binary}=${version}" >> "$GITHUB_OUTPUT"
+          done
+
+      - name: Re-embed checksums and regenerate scripts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          for binary in ${{ steps.changed.outputs.binaries }}; do
+            version=$(grep -A 1 'embedded_checksums:' "config/${binary}.binstaller.yml" \
+              | tail -1 | grep -oP 'v[\d.]+')
+            echo "Regenerating ${binary} at ${version}"
+            binst embed-checksums \
+              --config "config/${binary}.binstaller.yml" \
+              --version "${version}" \
+              --mode download
+            binst gen \
+              --config "config/${binary}.binstaller.yml" \
+              -o "scripts/${binary}-install.sh"
+          done
+
+      - name: Commit regenerated scripts
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add scripts/
+          git diff --cached --quiet || git commit -m "chore: regenerate install scripts"
+          git push

config/aichat.binstaller.yml

@@ -26,7 +26,7 @@ asset:
 checksums:
   algorithm: sha256
   embedded_checksums:
-    v0.30.0:
+    v0.30.0: # renovate: datasource=github-releases depName=sigoden/aichat
       - filename: aichat-v0.30.0-aarch64-apple-darwin.tar.gz
         hash: 680d36ed7f7ba8a2c2490a099df26c9da54495903c27956109a89c87eeb9edb3
       - filename: aichat-v0.30.0-aarch64-pc-windows-msvc.zip

config/binstaller.binstaller.yml

@@ -26,7 +26,7 @@ asset:
 checksums:
   algorithm: sha256
   embedded_checksums:
-    v0.12.0:
+    v0.12.0: # renovate: datasource=github-releases depName=binary-install/binstaller
       - filename: binst_Darwin_arm64.tar.gz
         hash: 2c3a8cf9b8f95edb5d97b905ccb0204800b25f1a9bc2b4ad704596e756e41eb9
       - filename: binst_Darwin_x86_64.tar.gz

config/eksctl.binstaller.yml

@@ -21,7 +21,7 @@ checksums:
   algorithm: sha256
   template: eksctl_checksums.txt
   embedded_checksums:
-    v0.221.0:
+    v0.221.0: # renovate: datasource=github-releases depName=eksctl-io/eksctl
     - filename: eksctl_Darwin_amd64.tar.gz
       hash: 9a5a3370ed79ffa646e25a0115aa7ee7fa203b284dffe058135b353be1542752
     - filename: eksctl_Darwin_arm64.tar.gz

config/gh-md-toc.binstaller.yml

@@ -11,7 +11,7 @@ checksums:
   algorithm: sha256
   template: checksums.txt
   embedded_checksums:
-    v2.0.0:
+    v2.0.0: # renovate: datasource=github-releases depName=ekalinin/github-markdown-toc.go
     - filename: gh-md-toc_2.0.0_darwin_amd64.tar.gz
       hash: 622626f7880f6b604e93c06638e948500f4b458703d4066e91bae5b857934666
     - filename: gh-md-toc_2.0.0_darwin_arm64.tar.gz

config/gh-pmu.binstaller.yml

@@ -7,7 +7,7 @@ checksums:
   algorithm: sha256
   template: checksums.txt
   embedded_checksums:
-    v0.14.3:
+    v0.14.3: # renovate: datasource=github-releases depName=rubrical-studios/gh-pmu
     - filename: darwin-amd64
       hash: 0a07dea041d1a76683884ae82fd9c4ecf8569c01d5bc03168b5dd15da471637a
     - filename: darwin-arm64

config/opentofu.binstaller.yml

@@ -8,7 +8,7 @@ checksums:
   algorithm: sha256
   template: tofu_${VERSION}_SHA256SUMS
   embedded_checksums:
-    v1.11.4:
+    v1.11.4: # renovate: datasource=github-releases depName=opentofu/opentofu
     - filename: tofu_1.11.4_darwin_amd64.tar.gz
       hash: 46abdd10b826e864f6daf2013a6f0dbc079d8c6e0f79b529138b7da50bea502f
     - filename: tofu_1.11.4_darwin_arm64.tar.gz

config/task.binstaller.yml

@@ -12,7 +12,7 @@ checksums:
   algorithm: sha256
   template: task_checksums.txt
   embedded_checksums:
-    v3.46.4:
+    v3.46.4: # renovate: datasource=github-releases depName=go-task/task
     - filename: task_darwin_amd64.tar.gz
       hash: 6e3d1bf5fcc03e50b2c02c92335923b715d3f61e27fef5b3048b59ed97a18721
     - filename: task_darwin_arm64.tar.gz

config/tenv.binstaller.yml

@@ -39,7 +39,7 @@ checksums:
   algorithm: sha256
   template: tenv_${TAG}_checksums.txt
   embedded_checksums:
-    v4.9.0:
+    v4.9.0: # renovate: datasource=github-releases depName=tofuutils/tenv
     - filename: tenv_v4.9.0_Darwin_arm64.tar.gz
       hash: 9fe1bea568d89c877198caa3af8cdf78c44263aedd6117feb783be4f242bf09b
     - filename: tenv_v4.9.0_Darwin_x86_64.tar.gz

config/tflint.binstaller.yml

@@ -8,7 +8,7 @@ checksums:
   algorithm: sha256
   template: checksums.txt
   embedded_checksums:
-    v0.60.0:
+    v0.60.0: # renovate: datasource=github-releases depName=terraform-linters/tflint
     - filename: tflint_darwin_amd64.zip
       hash: 256f70ad2c9963690bccc31ffda6be0159f1c5f857b46773b70d01d56b711280
     - filename: tflint_darwin_arm64.zip

config/toolhive.binstaller.yml

@@ -41,7 +41,7 @@ checksums:
       hash: 192bb1f0f9f257cad232e0148d81c3e31e644b888e61c22b46fa15b6b760547e
     - filename: toolhive_0.8.0_windows_arm64.zip
       hash: 313931641136da7479f02caf351c955c2d1d9bbc7204dff5f7f9d61ca1fd9242
-    v0.9.2:
+    v0.9.2: # renovate: datasource=github-releases depName=stacklok/toolhive
     - filename: toolhive_0.9.2_darwin_amd64.tar.gz
       hash: f8e45af89346a93678ed628552e68dae19a04f0b7402e1e545e5a53dd68ddb38
     - filename: toolhive_0.9.2_darwin_arm64.tar.gz

config/trivy.binstaller.yml

@@ -24,7 +24,7 @@ checksums:
   algorithm: sha256
   template: trivy_${VERSION}_checksums.txt
   embedded_checksums:
-    v0.68.2:
+    v0.68.2: # renovate: datasource=github-releases depName=aquasecurity/trivy
     - filename: trivy_0.68.2_Linux-64bit.tar.gz
       hash: 3d933bbc3685f95ec15280f620583d05d97ee3affb66944d14481d5d6d567064
     - filename: trivy_0.68.2_Linux-ARM64.tar.gz

config/trufflehog.binstaller.yml

@@ -8,7 +8,7 @@ checksums:
   algorithm: sha256
   template: trufflehog_${VERSION}_checksums.txt
   embedded_checksums:
-    v3.92.4:
+    v3.94.3: # renovate: datasource=github-releases depName=trufflesecurity/trufflehog
     - filename: trufflehog_3.92.4_darwin_amd64.tar.gz
       hash: 7599e25b2d9c8eea30aac873114bad54cb254a3dbc4b01cac52b28ef9f013f0e
     - filename: trufflehog_3.92.4_darwin_arm64.tar.gz

renovate.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base"],
+  "labels": ["renovate", "dependencies"],
+  "schedule": ["before 9am on monday"],
+  "prConcurrentLimit": 5,
+  "regexManagers": [
+    {
+      "fileMatch": ["^config/[^/]+\\.binstaller\\.yml$"],
+      "matchStrings": [
+        "\\s+(?<currentValue>v[\\d.]+):\\s+#\\s+renovate:\\s+datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)"
+      ],
+      "datasourceTemplate": "{{datasource}}",
+      "depNameTemplate": "{{depName}}"
+    }
+  ]
+}