SRE-904: Pass the Renovate token cipher key to housekeeping

[TimDiekmann]

Purpose

hashintel/.github#99 split the centralized Renovate workflow into a mint job and a run job; the installation token crosses the job boundary encrypted with RENOVATE_TOKEN_ENC_KEY. This wires the caller up to that contract, mirroring hashintel/hash#9192.

Related links

• SRE-904 (internal)
• SRE-904: Split token minting from the Renovate run .github#99
• SRE-904: Split token minting from the release run hash#9192

What does this change?

• housekeeping.yml: bump the hashintel/.github pin to b7a5d7f and pass RENOVATE_TOKEN_ENC_KEY through to the reusable workflow (the secret is already set on this repo)
• Remaining hashintel/.github pins bumped to the same SHA

How to test this?

• The Housekeeping validate job runs actionlint on the changed workflow (also validated locally with actionlint 1.7.12)
• After merge, the next scheduled Housekeeping run should mint the token in the split job and run Renovate as before

[cursor]

PR Summary

Low Risk
Workflow pin bumps and forwarding an existing repo secret into a reusable Renovate job; no application or auth logic changes in this repo.

Overview
Updates CI to match the split centralized Renovate workflow: reusable hashintel/.github workflow references move from 8c1a3b18 to b7a5d7f in housekeeping.yml, preflight.yml, and preflight-todo-comments.yml.

In housekeeping.yml, the renovate job now passes RENOVATE_TOKEN_ENC_KEY (from repo secrets) into housekeeping-dependencies, so the installation token can be encrypted when it crosses the mint/run job boundary introduced upstream.

^{Reviewed by Cursor Bugbot for commit fcb5cd1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Updates the repo’s GitHub Actions workflows to match the newer hashintel/.github “mint + run” Renovate split by passing the RENOVATE_TOKEN_ENC_KEY secret through to the housekeeping reusable workflow, and aligns all referenced reusable workflow pins to the same SHA.

Changes:

• Bumped hashintel/.github reusable workflow pins to b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5.
• Passed RENOVATE_TOKEN_ENC_KEY as a secret into the housekeeping dependencies reusable workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/preflight.yml	Updates reusable workflow pins for dependency and PR title preflight jobs.
.github/workflows/preflight-todo-comments.yml	Updates reusable workflow pin for todo-comments preflight job.
.github/workflows/housekeeping.yml	Updates housekeeping reusable workflow pin and forwards RENOVATE_TOKEN_ENC_KEY secret to satisfy the split-job Renovate contract.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.