SRE-891, SRE-904: Pass the Renovate cipher key and fix the todo-comments trigger

[TimDiekmann]

Purpose

hashintel/.github#99 split the centralized Renovate workflow into a mint job and a run job; the installation token crosses the job boundary encrypted with RENOVATE_TOKEN_ENC_KEY. This wires the caller up to that contract, mirroring hashintel/hash#9192, and re-enables the todo-comments scan on PRs.

Related links

• SRE-904 (internal)
• SRE-891 (internal)
• SRE-904: Split token minting from the Renovate run .github#99
• SRE-904: Split token minting from the release run hash#9192

What does this change?

• housekeeping.yml: bump the hashintel/.github pin to b7a5d7f and pass RENOVATE_TOKEN_ENC_KEY through to the reusable workflow (the secret is already set on this repo)
• preflight.yml: move the todo-comments job into a dedicated preflight-todo-comments.yml triggered on pull_request (matching hash and brunch). The reusable scan job is pull_request-only since SRE-891, so it was silently skipped when called under pull_request_target. The check name stays Todo comments / Scan.
• Remaining hashintel/.github pins bumped to the same SHA

How to test this?

• The Housekeeping validate job runs actionlint on the changed workflow (also validated locally with actionlint 1.7.12)
• The Todo comments / Scan check on this PR should now report success/failure instead of skipped

[cursor]

PR Summary

Low Risk
Workflow-only changes wiring an existing repo secret and fixing event triggers; no application runtime impact.

Overview
Updates CI to match the split hashintel/.github Renovate workflow and restores the Todo comments preflight check.

Housekeeping bumps the reusable workflow pin to b7a5d7f and passes RENOVATE_TOKEN_ENC_KEY into housekeeping-dependencies.yml so the encrypted installation token can cross the mint/run job boundary.

Todo comments moves out of preflight.yml into a new preflight-todo-comments.yml that runs on pull_request (including edited, since ticket IDs come from the PR title). The reusable scan only supports pull_request, so calling it from pull_request_target caused the check to be skipped; the job name stays Todo comments / Scan.

Other hashintel/.github reusable workflow pins in preflight/housekeeping are updated to the same SHA.

^{Reviewed by Cursor Bugbot for commit b29ef9c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Updates this repo’s GitHub Actions workflows to align with the split Renovate reusable workflow contract (mint/run job boundary) and restores the todo-comments scan so it runs under pull_request (instead of being silently skipped under pull_request_target).

Changes:

• Bump hashintel/.github reusable workflow pins to b7a5d7f….
• Add a dedicated preflight-todo-comments.yml workflow triggered on pull_request and remove the todo-comments job from preflight.yml.
• Pass RENOVATE_TOKEN_ENC_KEY into the Renovate housekeeping reusable workflow via secrets.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/preflight.yml	Updates reusable workflow pins and removes the inline todo-comments job from the main preflight workflow.
.github/workflows/preflight-todo-comments.yml	Introduces a dedicated workflow to run the todo-comments scan on pull_request events.
.github/workflows/housekeeping.yml	Updates the housekeeping reusable workflow pin and forwards RENOVATE_TOKEN_ENC_KEY to match the new Renovate job contract.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.