chore(deps): update schemastore digest to 5d5ed6c

[renovate]

This PR contains the following updates:

Package	Update	Change
schemastore (changelog)	digest	9291ce6 → 5d5ed6c

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

SchemaStore digest update: 9291ce6 → 5d5ed6c (21 commits)

Only one commit in this range touched a GitHub-related schema file:

• f06daf3d — feat(github-workflow): add concurrency.queue property to schema (#5679)

Changes to github-workflow.json:

• New optional queue property added to the concurrency object (both workflow-level and job-level)
  • Type: string, enum: ["single", "max"], default: "single"
  • Controls how pending jobs are queued in a concurrency group: single (at most 1 pending, default) vs max (up to 100 pending, FIFO)
  • Description text for concurrency updated in 3 places to mention the new field
• "required" array for concurrency unchanged (still only ["group"])

Changes to github-action.json: None — not touched in this range.

Breaking changes: None. The change is purely additive — a new optional property with a default value.

Security-related fixes: None.

🎯 Impact Scope Investigation

• The submodule is used exclusively by the code generator (cmd/gen/) to produce rules/invalid-workflow/generated.go and rules/invalid-action/generated.go. These generated files are checked into the repository.
• This PR updates only the submodule pointer. It does not re-run go generate, so generated.go is not regenerated.
• Current generated.go (lines 92–94, 408–410) knows only cancel-in-progress and group as valid concurrency keys. After this merge, ghasec would produce a false-positive "unknown key" error for workflows using concurrency.queue: max.
• github-action.json was not changed, so rules/invalid-action/generated.go is unaffected.
• All CI checks pass (build, lint, test) — confirming no compilation or test regressions.

💡 Recommended Actions

• Merge is safe — the submodule update itself introduces no runtime or compilation issues.
• After merging, run the code generator to incorporate the new queue property and eliminate the potential false-positive:

  go generate ./rules/invalid-workflow/ ./rules/invalid-action/

  Then commit the regenerated rules/invalid-workflow/generated.go. This will add "queue": true to the _knownKeysconcurrency maps and emit enum validation for ["single", "max"].
• Consider adding an E2E test fixture (valid-concurrency-queue.yml) that uses concurrency.queue: max to prevent regressions.

🔗 Reference Links

• SchemaStore commit comparison 9291ce6→5d5ed6c
• SchemaStore PR #5679 — feat(github-workflow): add concurrency.queue property
• GitHub Actions docs: concurrency.queue

Generated by koki-develop/claude-renovate-review