Add dependency monitoring with Renovate and OSV scanning

[hdp617]

Summary

Implements the full dependency monitoring approach: pinned chezmoi externals, Renovate automation, and scheduled vulnerability scanning.

Changes

Pinned archive externals (.chezmoiexternal.toml)

• Replaces floating git-repo clones with pinned GitHub archive URLs (tags or commit SHAs).
• Adds missing nord-dircolors external for zsh dircolors.
• Versions are visible in-repo so Renovate and OSV-Scanner can track them.

Dependency	Pin
nerdtree	tag 7.1.3
vim-go	tag v1.29
vim-polyglot	tag v4.17.0
incsearch.vim	tag v2.0.1
zsh-syntax-highlighting	tag 0.8.0
zsh-completions	tag 0.36.0
nord-dircolors	tag v0.2.0
lightline.vim, material.vim	commit SHA (no releases)

Renovate (.github/renovate.json)

• Bumps chezmoi archive tag and SHA URLs.
• Bumps brew / cask / go lines in dot_Brewfile (Repology + Go module index).
• Groups updates and enables the dependency dashboard.

Requires: install the Renovate GitHub App on this repo.

CI

• chezmoi.yml — template render + dry-run apply; pins chezmoi v2.71.0.
• dependency-audit.yml — weekly OSV-Scanner on downloaded externals; macOS job reports outdated Homebrew packages in the job summary.

Docs

• README Dependency monitoring section with setup steps.

Migration

After merge, run once on each machine:

chezmoi apply --refresh-externals=always

Existing git-repo checkouts under vim/, zsh/plugins/, and shell/plugins/ will be replaced by pinned archives.

Test plan

• Install Renovate app and confirm it parses .github/renovate.json
• chezmoi apply --refresh-externals on a dev machine
• Verify vim/zsh plugins load (:NERDTreeToggle, zsh syntax highlighting)
• CI workflows pass on this PR

  

[gemini-code-assist]

Code Review

This pull request migrates Chezmoi externals from git-repo to pinned archive URLs and introduces a Renovate configuration to automate dependency updates for these archives, Homebrew formulae/casks, and Go tools. Feedback on the Renovate configuration highlights critical issues: the git-refs custom manager requires a fully qualified packageNameTemplate to fetch repository references correctly, and the Homebrew custom managers should use packageNameTemplate instead of the invalid lookupNameTemplate property.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

For the git-refs datasource, the packageName must be a fully qualified domain name (e.g., https://github.com/owner/repo). Since depName only captures the owner/repo path, Renovate will default packageName to depName and fail to fetch the references. Adding a packageNameTemplate pointing to the full GitHub repository URL fixes this.

    {
      "customType": "regex",
      "description": "Chezmoi archive externals pinned to commit SHAs",
      "managerFilePatterns": ["^\\.chezmoiexternal\\.toml$"],
      "matchStrings": [
        "url = \"https://github\\.com/(?<depName>[^/]+/[^/]+)/archive/(?<currentDigest>[a-f0-9]{40})\\.tar\\.gz\""
      ],
      "datasourceTemplate": "git-refs",
      "packageNameTemplate": "https://github.com/{{{depName}}}",
      "currentValueTemplate": "HEAD",
      "versioningTemplate": "git"
    }

[gemini-code-assist]

In Renovate custom managers, lookupNameTemplate is not a valid configuration option. The correct and standard field name to specify the package name used for lookups is packageNameTemplate.

    {
      "customType": "regex",
      "description": "Homebrew formulae in dot_Brewfile",
      "managerFilePatterns": ["^dot_Brewfile$"],
      "matchStrings": [
        "^brew \"(?<depName>[a-z0-9][a-z0-9+@._/-]*)\"\\s*$"
      ],
      "datasourceTemplate": "repology",
      "packageNameTemplate": "homebrew/{{{depName}}}",
      "versioningTemplate": "loose"
    }

[gemini-code-assist]

In Renovate custom managers, lookupNameTemplate is not a valid configuration option. The correct and standard field name to specify the package name used for lookups is packageNameTemplate.

    {
      "customType": "regex",
      "description": "Homebrew casks in dot_Brewfile",
      "managerFilePatterns": ["^dot_Brewfile$"],