ci: validate the shared dependency update policy

.github/workflows/validate-renovate-config.yml

@@ -0,0 +1,24 @@
+name: Validate Renovate config
+
+on:
+  pull_request:
+    paths:
+      - renovate-config.json
+      - renovate.json
+      - bin/validate-renovate-config
+      - .github/workflows/validate-renovate-config.yml
+  push:
+    branches:
+      - main
+    paths:
+      - renovate-config.json
+      - renovate.json
+      - bin/validate-renovate-config
+      - .github/workflows/validate-renovate-config.yml
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: ./bin/validate-renovate-config

bin/validate-renovate-config

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+files=()
+for candidate in renovate-config.json renovate.json; do
+  [ -f "$candidate" ] && files+=("$candidate")
+done
+
+if [ ${#files[@]} -eq 0 ]; then
+  echo "no renovate config files found; nothing was validated" >&2
+  exit 1
+fi
+
+status=0
+for file in "${files[@]}"; do
+  if ! jq empty "$file" >/dev/null 2>&1; then
+    echo "$file: not strict JSON" >&2
+    status=1
+  fi
+done
+[ "$status" -eq 0 ] || exit "$status"
+
+npx --yes --package renovate -- renovate-config-validator --strict "${files[@]}"