Merge pull request 'chore(deps): update actions/checkout action to v7' (#1) from renovate/actions-checkout-7.x into main

Reviewed-on: #1

.gitea/workflows/docker.yaml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Replace build placeholders
         uses: https://git.custom-coding.net/templates/replace-build-vars@v1

README.md

@@ -48,3 +48,10 @@ Every build is tagged `:latest`, plus one tag based on the ref:
 Only major tags (`v1`, `v2`, …). Fixes move the existing tag. Changing inputs, secrets or tagging behavior needs a new major tag.
 
 History before the move: [UltimateCoder/resuable-workflows](https://git.custom-coding.net/UltimateCoder/resuable-workflows) (`@v1`–`@v3` there remain frozen).
+
+## Entscheidungen
+
+Decisions by the owner of the `templates` org:
+
+- 2026-10-15: Only major tags (`v1`, `v2`, …), no `vX.Y.Z` tags (see Versioning).
+- 2026-10-17: All repos in the `templates` org are public, so consumers' runners can fetch them without credentials. They never contain secrets or internal addresses: secrets come in as `secrets:`, hosts as inputs.

renovate.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "timezone": "Europe/Berlin",
+  "enabledManagers": ["github-actions"],
+  "packageRules": [
+    {
+      "description": "No automerge: these repos have no build that could gate an update, and a change on main only reaches consumers when the templates session moves a vN tag after a live test in a consumer repo.",
+      "matchPackageNames": ["*"],
+      "automerge": false
+    }
+  ]
+}