Restore Renovate runner and test runtime before upgrades

.github/renovate.json

@@ -106,6 +106,7 @@
       "matchDepNames": [
         "matrix-renovate-runner"
       ],
+      "allowedVersions": "!/^44\\.64\\.0$/",
       "automerge": true,
       "automergeType": "branch"
     },

.github/workflows/renovate-smoke-test.yml

@@ -11,11 +11,13 @@ on:  # yamllint disable-line rule:truthy
       - '.github/renovate.json'
       - '.github/workflows/renovate-smoke-test.yml'
       - '.github/workflows/renovate.yml'
+      - 'bin/renovate-smoke-test.sh'
   pull_request:
     paths:
       - '.github/renovate.json'
       - '.github/workflows/renovate-smoke-test.yml'
       - '.github/workflows/renovate.yml'
+      - 'bin/renovate-smoke-test.sh'
   workflow_dispatch:
 
 permissions:
@@ -23,8 +25,9 @@ permissions:
 
 jobs:
   validate:
-    name: Validate config with the pinned Renovate image
+    name: Validate config and runtime with the pinned Renovate image
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     # Same-repository pull requests already run via the push event;
     # run pull_request jobs only for pull requests from forks.
@@ -34,32 +37,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
-      - name: Resolve the pinned Renovate version
-        id: renovate_version
+      - name: Validate configuration and extract repository dependencies
         shell: bash
-        run: |
-          set -euo pipefail
-
-          mapfile -t versions < <(
-            sed -n "s/^  MATRIX_RENOVATE_VERSION: '\([^']*\)'$/\1/p" \
-              .github/workflows/renovate.yml
-          )
-
-          if (( ${#versions[@]} != 1 )) || [[ -z "${versions[0]}" ]]; then
-            echo 'Could not resolve exactly one pinned Renovate version' >&2
-            exit 1
-          fi
-
-          echo "version=${versions[0]}" >> "$GITHUB_OUTPUT"
-
-      - name: Validate the Renovate configuration
-        env:
-          RENOVATE_VERSION: ${{ steps.renovate_version.outputs.version }}
-        run: |
-          docker run --rm \
-            --volume "$GITHUB_WORKSPACE:/workspace:ro" \
-            --workdir /workspace \
-            --entrypoint renovate-config-validator \
-            "ghcr.io/renovatebot/renovate:$RENOVATE_VERSION" \
-            --strict
+        run: bin/renovate-smoke-test.sh

.github/workflows/renovate.yml

@@ -43,7 +43,7 @@ env:
   MATRIX_RENOVATE_AUTOMATION_ENABLED: 'true'
 
   # renovate: datasource=docker depName=matrix-renovate-runner packageName=ghcr.io/renovatebot/renovate
-  MATRIX_RENOVATE_VERSION: '44.64.0'
+  MATRIX_RENOVATE_VERSION: '44.61.6'
 
 jobs:
   preflight:
@@ -146,6 +146,8 @@ jobs:
           renovate-version: ${{ env.MATRIX_RENOVATE_VERSION }}
         env:
           LOG_LEVEL: ${{ inputs.log_level || 'info' }}
+          # Renovate's rejection handler can log a startup crash and still exit 0.
+          NODE_OPTIONS: --unhandled-rejections=strict
           RENOVATE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && 'full' || '' }}
           # Permit the self-hosted App to adopt branches created by the Mend-hosted App.
           RENOVATE_GIT_IGNORED_AUTHORS: '["29139614+renovate[bot]@users.noreply.github.com"]'