Renovate regex manager matches versioned URLs in layout.rb and
proposes updates from npm. rake cdn:rehash regenerates the
integrity hashes after a version bump.

Assisted-by: Claude Opus 4.6 via pi

diff --git a/Rakefile b/Rakefile
index 32ce3de..504fa0c 100644
--- a/Rakefile
+++ b/Rakefile
@@ -134,6 +134,24 @@ namespace :snapshots do
   end
 end
 
+namespace :cdn do
+  desc "Update integrity hashes for CDN scripts in layout.rb"
+  task :rehash do
+    layout = "lib/ketchup/views/layout.rb"
+    content = File.read(layout)
+
+    content.gsub!(%r{src:\s*"(https://[^"]+)".*\n\s*integrity:\s*"sha384-[^"]+"}) do |match|
+      url = match[/"(https:\/\/[^"]+)"/, 1]
+      hash = `curl -sL '#{url}' | openssl dgst -sha384 -binary | openssl base64 -A`.strip
+      abort "Failed to fetch #{url}" if hash.empty?
+      puts "#{url} -> sha384-#{hash}"
+      match.sub(/sha384-[^"]+/, "sha384-#{hash}")
+    end
+
+    File.write(layout, content)
+  end
+end
+
 desc "Generate RBS from inline annotations and run Steep type checker"
 task :check do
   sh "rbs-inline --output lib/"
diff --git a/renovate.json b/renovate.json
index b6f81a2..722ab46 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,8 +3,19 @@
   "extends": ["config:recommended"],
   "packageRules": [
     {
-      "matchManagers": ["bundler", "github-actions"],
+      "matchManagers": ["bundler", "dockerfile", "github-actions", "ruby-version"],
       "schedule": ["every weekend"]
     }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["lib/ketchup/views/layout\\.rb$"],
+      "matchStrings": [
+        "src:\\s*\"https://unpkg\\.com/(?<depName>[^@]+)@(?<currentValue>[^/]+)/",
+        "src:\\s*\"https://cdn\\.jsdelivr\\.net/npm/(?<depName>[^@]+)@(?<currentValue>[^/]+)/"
+      ],
+      "datasourceTemplate": "npm"
+    }
   ]
 }