ci: update pinned hashes on renovate updates

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

.github/workflows/test-go-generate.yml

@@ -17,6 +17,7 @@ jobs:
         with:
           path: constellation
           ref: ${{ github.head_ref }}
+          token: ${{ secrets.TIDY_RENOVATE_PUSH }}
 
       - name: Setup Go
         uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
@@ -42,6 +43,7 @@ jobs:
           echo "submods=${mods}" >> "$GITHUB_OUTPUT"
 
       - name: Go generate check
+        id: generatecheck
         shell: bash
         working-directory: constellation
         run: |
@@ -50,3 +52,17 @@ jobs:
               go generate $mod/...
           done
           git diff --exit-code
+
+      - name: Push changes on renovate branch
+        if: failure() && (steps.generatecheck.conclusion == 'failure') && startsWith(github.head_ref, 'renovate/')
+        shell: bash
+        working-directory: constellation
+        run: |
+          diff_dirs=$(git diff --name-only)
+          if [[ "${diff_dirs}" == "internal/versions/versions.go" ]]; then
+            echo "internal/versions/versions.go is the only changed file, so we can push the changes."
+            git config --global user.name "renovate[bot]"
+            git config --global user.email "29139614+renovate[bot]@users.noreply.github.com"
+            git commit -am "[bot] Update versions.go"
+            git push
+          fi