fix(renovate): match annotations separated from default by a type line

.github/workflows/lint-workflows.yml

@@ -11,8 +11,8 @@ on:
         type: string
         default: '["ubuntu-latest"]'
       actionlint-version:
-        # renovate: datasource=github-releases depName=rhysd/actionlint
         type: string
+        # renovate: datasource=github-releases depName=rhysd/actionlint
         default: "1.7.12"
       actionlint-ignore:
         description: "Newline-separated -ignore patterns. Each becomes one `-ignore PATTERN` arg."

.github/workflows/secret-scan.yml

@@ -17,8 +17,8 @@ on:
         type: string
         default: '["ubuntu-latest"]'
       betterleaks-version:
-        # renovate: datasource=github-releases depName=betterleaks/betterleaks
         type: string
+        # renovate: datasource=github-releases depName=betterleaks/betterleaks
         default: "1.8.1"
       config-path:
         description: "Path to .betterleaks.toml (or a legacy .gitleaks.toml). Empty = betterleaks auto-discovers one in the repo root, else uses defaults."

.github/workflows/toml-lint.yml

@@ -13,8 +13,8 @@ on:
         type: string
         default: '["ubuntu-latest"]'
       taplo-version:
-        # renovate: datasource=github-releases depName=tamasfe/taplo
         type: string
+        # renovate: datasource=github-releases depName=tamasfe/taplo
         default: "0.10.0"
       run-fmt-check:
         type: boolean

CHANGELOG.md

@@ -6,6 +6,25 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
 
 ## [Unreleased]
 
+### Fixed
+
+- Renovate's `customManager` now matches every `# renovate:` annotation in
+  the repo (8 of 8, previously 5). The regex anchored `default:` to the line
+  *immediately* after the comment, so three inputs that carried a `type:`
+  line in between — `actionlint-version`, `betterleaks-version` and
+  `taplo-version` — were silently skipped. Those pins would never have been
+  offered an update, and a dashboard with nothing on it looks identical to
+  one where everything is current.
+
+  Two changes, belt and braces: the three annotations moved to sit directly
+  above their `default:`, matching the convention the other five already
+  followed; and the regex now tolerates intervening `type:`/`required:`
+  lines so the next input added does not reintroduce the problem. The skip
+  list stops at those two keys deliberately — both are always single-line
+  scalars, whereas `description:` is often a `|` block, and skipping it
+  would let an annotation bind across arbitrary text to an unrelated
+  `default:` further down the file.
+
 ## [3.2.1] - 2026-09-01
 
 ### Fixed

renovate.json

@@ -25,7 +25,7 @@
       "description": "Update pinned versions referenced as input defaults",
       "fileMatch": ["^\\.github/(workflows|actions)/.+\\.ya?ml$"],
       "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>.+?)\\s+depName=(?<depName>.+?)(?:\\s+versioning=(?<versioning>.+?))?\\s*\\n\\s*default:\\s*[\"']?(?<currentValue>[^\"'\\s]+)"
+        "#\\s*renovate:\\s*datasource=(?<datasource>.+?)\\s+depName=(?<depName>.+?)(?:\\s+versioning=(?<versioning>.+?))?[ \\t]*\\n(?:[ \\t]*(?:type|required):[^\\n]*\\n)*[ \\t]*default:[ \\t]*[\"']?(?<currentValue>[^\"'\\s]+)"
       ]
     }
   ]