add self-validate workflow

.github/workflows/renovate-validate.yaml

@@ -0,0 +1,27 @@
+# This is _NOT_ a reusable workflow, but rather the renovate run for this repo itself.
+name: Validate renovate config
+on:
+  pull_request:
+    paths:
+      # When renovate config changes:
+      - "renovate.*"
+      - ".renovate.*"
+      - ".github/renovate.*"
+      # Also when renovate version changes:
+      - ".github/workflows/*"
+      # For this repo specifically, also when actions themselves change.
+      - ".github/actions/*"
+
+jobs:
+  renovate:
+    permissions:
+      # Needed for logging into vault.
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Validate renovate config
+        uses: ./actions/renovate-validate

.github/workflows/renovate.yaml

@@ -0,0 +1,24 @@
+# This is _NOT_ a reusable workflow, but rather the renovate run for this repo itself.
+name: Self-hosted Renovate
+
+on:
+  schedule:
+    - cron: "22 */4 * * *"
+  # Run this job on PRs to, in dry run mode, as a sort of self-check.
+  pull_request:
+
+jobs:
+  renovate:
+    permissions:
+      # Needed for logging into vault.
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Self-hosted renovate
+        uses: ./actions/renovate-validate
+        with:
+          dry-run: "${{ github.event_name == 'pull_request' }}"