images: pin digest and set image rebuild schedule

.gitea/workflows/build.yml

@@ -3,6 +3,11 @@ name: build
 on:
   push:
     branches: [main]
+    paths:
+      - 'images/**'
+      - '.gitea/workflows/build.yml'
+  schedule:
+    - cron: '0 4 * * 0' ## weekly sunday 04:00 UTC rebuild
   workflow_dispatch:
 
 jobs:

images/act/Dockerfile

@@ -1,4 +1,5 @@
-FROM docker.gitea.com/runner-images:ubuntu-latest
+## renovate: datasource=docker depName=docker.gitea.com/runner-images
+FROM docker.gitea.com/runner-images:ubuntu-latest@sha256:0e62e56b382ebf485bff1e51a05cbe27c708545a2e91425467fd31eb3e249521
 
 RUN set -eux; \
     apt-get update; \

images/act/README.md

@@ -2,4 +2,4 @@
 
 Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed, plus `rsync` from apt.
 
-Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json).
+Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`, weekly on a schedule (Sunday 04:00 cron), and on manual dispatch. The base image is pinned by digest so Renovate opens a PR whenever `runner-images:ubuntu-latest` changes; update `SOPS_VERSION` in `Dockerfile` to bump SOPS (both tracked in renovate.json).