Renovate external secrets version

Adapt versioning system since external-secrets/apis module is not versioned anymore.

• Monitor the main module (go) for external-secrets/external-secrets: v1.2.3 in workload-cluster-operator/config/crd/tests-deps/kustomization.yaml
• Creates a pseudo version based on the hash of the main module's version for external-secrets/external-secrets/apis: v0.0.0-20260011223344-123456789876 in workload-cluster-operator/go.mod + workload-cluster-operator/go.sum

Process to get the pseudo version from the tagged commit in the main branch:

SOLUTION 1

1. Download the main version: go mod download github.com/external-secrets/external-secrets@v1.2.3
2. Get the Commit Hash: go list -m -json github.com/external-secrets/external-secrets@v1.2.3
3. Get the Time (YYYYMMDDHHMMSS) - check if it's GMT+1, might not work without changing hours -git show -s --format=%cd --date=format:'%Y%m%d%H%M%S' <Commit Hash>
4. Get the Short Commit Hash: git rev-parse --short=12 <Commit Hash>
5. Build the Pseudo Version: v0.0.0-<Time>-<Short Commit Hash>
6. Verify that the /apis pseudo version exists: go get github.com/external-secrets/external-secrets/apis@<Pseudo Version>

SOLUTION 2

1. Find the commit related to the latest github release tag
   git ls-remote --tags https://github.com/external-secrets/external-secrets v2.9.0
378bdb622ed9712ef4a58370f6a17af033b7d343 refs/tags/v2.9.0
2. Get the Short Commit Hash
   git rev-parse --short=12 378bdb622ed9712ef4a58370f6a17af033b7d343 \
   378bdb622ed9
3. Get the Time (YYYYMMDDHHMMSS)
   curl -s -H "Authorization: GITHUB_TOKEN" "https://api.github.com/repos/external-secrets/external-secrets/git/commits/378bdb622ed9712ef4a58370f6a17af033b7d343" \ | jq -r '.committer.date'
2026-08-07T16:04:37Z
date -u -d "2026-08-07T16:04:37Z" +"%Y%m%d%H%M%S"
20260807160437
4. Build the Pseudo Version: v0.0.0-20260807160437-378bdb622ed9
5. Verify that the /apis pseudo version exists
   go list -m -json github.com/external-secrets/external-secrets/apis@v0.0.0-20260807160437-378bdb622ed9

Solution 2 was implemented since it fetches the latest github release tag.

As for Renovate config, some specificity regarding the external-secrets repo:

• "groupName": "external-secrets-operator": the group name to regroup in 1 MR
• "separateMajorMinor": false: all version changes will be added to the group regardless of the major/minor versions
• Native gomod and kustomize are disabled for external-secrets and external-secrets/apis, but kustomize is enabled only for external-secrets
• A python script is running as a postUpgradeTasks that should be allowed inside config.js main Renovate configuration (see related MR for this: https://gitlab.com/sylva-projects/sylva-elements/renovate/-/merge_requests/256)
• As a result, a JSON file is created with desired data, and files are updated.

Closes #63 (closed)