Validate the configured Docker Hub credentials against the token service and a public manifest before starting a full Renovate scan. Provide a small manual workflow so maintainers can diagnose authentication without consuming a full scan.
Strip image digests before deriving app directory versions, while continuing to reject digest-only images. Document the cache privacy boundary, restrict the workflow token to read-only, and bound full scans to 90 minutes.
Restore and save Renovate's public lookup and repository extraction cache with a SHA-pinned GitHub action. Keep private package caching disabled and report cache growth for quota monitoring.
Give the Mend App and the self-hosted Docker scanner disjoint manager scopes, branch namespaces, and dependency dashboards so they cannot close each other's PRs. Preserve the existing Compose policy in a dedicated config and document the scaling boundary.
okxlin