ci: update Windows build pins with Renovate (#3049)

`setup-xwin` pins `cargo-xwin` and the Windows SDK without Renovate
coverage, so updates require manual edits.

Add Renovate managers for `cargo-xwin` and the SDK release. Update the
SDK version and archive SHA-256 together. Derive the download URL and
SDK cache key from these pins.

Group these updates in one PR and set `automerge: false` to require
review. Keep the `Clang 22` requirement explicit.

Author: fengmk2

.github/actions/setup-xwin/action.yml

@@ -34,9 +34,25 @@ runs:
     - run: rustup target add x86_64-pc-windows-msvc
       shell: bash
 
+    - name: Set Windows build versions
+      id: versions
+      shell: bash
+      run: |
+        {
+          echo "tools=${EXTRA_TOOLS:+$EXTRA_TOOLS,}cargo-xwin@$CARGO_XWIN_VERSION"
+          echo "sysroot-version=$SYSROOT_VERSION"
+          echo "sysroot-sha256=$SYSROOT_SHA256"
+        } >> "$GITHUB_OUTPUT"
+      env:
+        EXTRA_TOOLS: ${{ inputs.tools }}
+        # Renovate updates these pins. Keep the SDK version and checksum together.
+        CARGO_XWIN_VERSION: '0.23.1'
+        SYSROOT_VERSION: '2026-09-15'
+        SYSROOT_SHA256: 6aeecd2d25bcc90c72af09dc525dfdf7143c374d476dc4296692d42efb27a9b9
+
     - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
       with:
-        tool: ${{ inputs.tools != '' && format('{0},cargo-xwin@0.23.1', inputs.tools) || 'cargo-xwin@0.23.1' }}
+        tool: ${{ steps.versions.outputs.tools }}
 
     # A packaged sysroot avoids unpacking Microsoft's installer archives
     # on every cache miss. Keep the clang-cl compiler driver.
@@ -74,7 +90,7 @@ runs:
           ~/.cache/cargo-xwin/windows-msvc-sysroot/include
           ~/.cache/cargo-xwin/windows-msvc-sysroot/lib/x86_64-unknown-windows-msvc
           ~/.cache/cargo-xwin/xwin
-        key: cargo-xwin-sysroot-2026-09-15-clang-cl-22-x64-v1
+        key: cargo-xwin-sysroot-${{ steps.versions.outputs.sysroot-version }}-${{ steps.versions.outputs.sysroot-sha256 }}-clang-cl-22-x64-v1
 
     - name: Download pinned Windows SDK
       if: steps.sysroot-cache.outputs.cache-hit != 'true'
@@ -111,5 +127,5 @@ runs:
         # cargo-xwin uses this marker to reuse the verified SDK layout.
         printf 'x86_64\n' > "$xwin/DONE"
       env:
-        SYSROOT_URL: https://github.com/trcrsired/windows-msvc-sysroot/releases/download/2026-09-15/windows-msvc-sysroot.tar.xz
-        SYSROOT_SHA256: 6aeecd2d25bcc90c72af09dc525dfdf7143c374d476dc4296692d42efb27a9b9
+        SYSROOT_URL: https://github.com/trcrsired/windows-msvc-sysroot/releases/download/${{ steps.versions.outputs.sysroot-version }}/windows-msvc-sysroot.tar.xz
+        SYSROOT_SHA256: ${{ steps.versions.outputs.sysroot-sha256 }}

.github/renovate.json

@@ -20,9 +20,36 @@
       "depNameTemplate": "voidzero-dev/setup-vp",
       "datasourceTemplate": "github-releases",
       "versioningTemplate": "semver-coerced"
+    },
+    {
+      "description": "Update the cargo-xwin version used for Windows builds.",
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/actions/setup-xwin/action\\.yml$/"],
+      "matchStrings": ["CARGO_XWIN_VERSION: '(?<currentValue>[^']+)'"],
+      "depNameTemplate": "cargo-xwin",
+      "datasourceTemplate": "crate"
+    },
+    {
+      "description": "Update the Windows SDK release and its archive checksum together.",
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/actions/setup-xwin/action\\.yml$/"],
+      "matchStrings": [
+        "SYSROOT_VERSION: '(?<currentValue>\\d{4}-\\d{2}-\\d{2})'\\s+SYSROOT_SHA256: (?<currentDigest>[a-f0-9]{64})"
+      ],
+      "depNameTemplate": "trcrsired/windows-msvc-sysroot",
+      "datasourceTemplate": "github-release-attachments",
+      "versioningTemplate": "regex:^(?<major>\\d{4})-(?<minor>\\d{2})-(?<patch>\\d{2})$"
     }
   ],
   "packageRules": [
+    {
+      "description": "Require review for Windows SDK and cargo-xwin updates.",
+      "matchManagers": ["custom.regex"],
+      "matchFileNames": [".github/actions/setup-xwin/action.yml"],
+      "matchPackageNames": ["cargo-xwin", "trcrsired/windows-msvc-sysroot"],
+      "groupName": "Windows build toolchain",
+      "automerge": false
+    },
     {
       "description": "Ignore toolchain npm packages managed by .github/workflows/upgrade-deps.yml through upgrade-deps.ts and sync-remote. Official Vitest packages share the runner version; the independently versioned @vitest/browser-webdriverio remains enabled.",
       "matchManagers": ["npm"],