Repoconsistency for learning

[ruokun-niu]

Description

This pull request makes several changes to the repository’s GitHub Actions workflows, primarily focused on security improvements, dependency management, and updating action versions. The automerge workflow for Renovate PRs is removed, new security analysis workflows are added, and several actions are updated to their latest major versions for improved performance and security.

Type of change

• This pull request fixes a bug in Drasi and has an approved issue (issue link required).
• This pull request adds or changes features of Drasi and has an approved issue (issue link required).
• This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Drasi (issue link optional).

Fixes: #issue_number

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

This pull request updates repository automation and security posture by removing Renovate automerge-related configuration, adding new security scanning workflows, and updating several GitHub Actions dependencies to newer major versions.

Changes:

• Removed Renovate configuration and the Renovate automerge workflow.
• Added supply-chain/security analysis workflows (OpenSSF Scorecard, DevSkim).
• Updated multiple workflows to use newer major versions of common GitHub Actions (e.g., checkout, upload-artifact).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
renovate.json	Removes Renovate configuration for dependency update grouping/labeling and dashboard approval rules.
.github/workflows/automerge.yml	Removes scheduled/manual Renovate PR automerge workflow.
.github/workflows/tutorial-evaluation.yml	Updates action versions used in tutorial evaluation runs (checkout, artifact upload).
.github/workflows/tutorial-evaluation-scheduled.yml	Updates action versions used in scheduled tutorial evaluation runs (checkout, artifact upload).
.github/workflows/build-tutorial-images.yml	Updates checkout action version used when building/pushing tutorial images.
.github/workflows/manual-build-images.yml	Updates checkout action version used for manually building tutorial images.
.github/workflows/release.yml	Pins actions/checkout to the v5.0.0 commit SHA for the release workflow.
.github/workflows/scorecard.yml	Adds an OpenSSF Scorecard workflow with pinned action SHAs and SARIF upload.
.github/workflows/devskim.yml	Adds a DevSkim workflow via a reusable workflow call.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.