ci: add Renovate for actions-runner and tighten CI triggers

Track only the upstream base image with fix: PRs for release-please, and limit CI pushes to main/PR to avoid Renovate branch image spam.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: zzswang

.github/workflows/ci.yml

@@ -3,11 +3,12 @@ name: CI
 on:
   push:
     branches:
-      - '*'
+      - main
   pull_request:
     types: [opened, reopened, edited, synchronize]
     branches:
-      - 'main'
+      - main
+
 
 permissions: write-all
 

renovate.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "semanticCommits": "enabled",
+  "commitMessagePrefix": "fix:",
+  "commitMessageAction": "bump",
+  "commitMessageTopic": "actions-runner",
+  "prTitle": "fix: bump actions-runner to {{newVersion}}",
+  "packageRules": [
+    {
+      "description": "Only track upstream actions-runner base image",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["ghcr.io/actions/actions-runner"],
+      "enabled": true
+    },
+    {
+      "description": "Disable everything else in this repo",
+      "matchPackagePatterns": ["*"],
+      "excludePackageNames": ["ghcr.io/actions/actions-runner"],
+      "enabled": false
+    }
+  ]
+}