Fix renovate-nix.json5 preset and validate presets in CI

.github/renovate-nix.json5

@@ -25,7 +25,7 @@
       matchBaseBranches: [
         'main',
         // Release 2.2 and newer use nix.
-        '/'^release-2\.([2-9]|..+)$/',
+        '/^release-2\.([2-9]|..+)$/',
       ],
       postUpgradeTasks: {
         commands: [
@@ -46,7 +46,7 @@
       matchBaseBranches: [
         'main',
         // Release 2.2 and newer use nix.
-        '/'^release-2\.([2-9]|..+)$/',
+        '/^release-2\.([2-9]|..+)$/',
       ],
       postUpgradeTasks: {
         commands: [

.github/workflows/ci.yml

@@ -33,6 +33,26 @@ jobs:
       - name: Verify Generated Code
         run: nix build .#checks.x86_64-linux.generate --print-build-logs
 
+  validate-renovate-config:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      # renovate-config-validator only looks at the top-level file and does
+      # not recursively resolve local> presets, so we also syntax-check every
+      # renovate*.json5 with the json5 CLI to catch preset parse errors at
+      # PR time rather than 24h later in the scheduled Renovate job.
+      - name: Validate Renovate preset syntax
+        run: |
+          for f in .github/renovate*.json5; do
+            npx --yes json5 "$f" > /dev/null
+          done
+
+      - name: Validate Renovate JSON
+        run: npx --yes --package renovate -- renovate-config-validator
+
   lint:
     runs-on: ubuntu-22.04
 

.github/workflows/renovate.yml

@@ -24,9 +24,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      # Don't waste time starting Renovate if JSON is invalid
+      # Don't waste time starting Renovate if any preset is unparseable.
+      # renovate-config-validator only looks at the top-level file and does
+      # not recursively resolve local> presets, so we also syntax-check every
+      # renovate*.json5 with the json5 CLI.
+      - name: Validate Renovate preset syntax
+        run: |
+          for f in .github/renovate*.json5; do
+            npx --yes json5 "$f" > /dev/null
+          done
+
       - name: Validate Renovate JSON
-        run:  npx --yes --package renovate -- renovate-config-validator
+        run: npx --yes --package renovate -- renovate-config-validator
 
       - name: Get token
         id: get-github-app-token