Renovate rejected the previous form because a "VAR=1 cmd" prefix needs both an allowedCommands entry and the shell executor. A plain argument keeps the task matchable by a single pattern, like the vendor hash task next to it.