From bd1f441656c0e0c47411bc70a3a874f324cf1ccb Mon Sep 17 00:00:00 2001
From: Marco Comi <9998393+kin0992@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:48:05 +0200
Subject: [PATCH 1/2] Adopt Renovate, retire Dependabot version updates

Replace Dependabot version-update PRs with Renovate, which covers
surfaces Dependabot misses in this repo: the pnpm catalog in
pnpm-workspace.yaml, the packageManager pin, .node-version, and the
pinned waza CLI version in the eval workflow.

- renovate.json mirrors the old Dependabot grouping (github-actions,
  dev/prod non-major) plus a catalog-toolchain group, runs weekly,
  and enables lockfile maintenance and a dependency dashboard.
- Semantic commits are disabled so update PRs follow this repo's
  classic commit-message convention rather than Conventional Commits.
- Digest, pin, and patch updates automerge once required checks pass.
- A custom manager bumps WAZA_VERSION; WAZA_SHA256 stays manual and is
  guarded by the workflow's existing sha256sum check.

Dependabot security alerts and security updates (managed via Pulumi)
are unaffected; only the version-update config is removed to avoid
duplicate PRs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/dependabot.yml | 23 -----------------
 renovate.json          | 56 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 23 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 renovate.json

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 95c097a..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: '/'
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 10
-    groups:
-      actions:
-        patterns: ['*']
-
-  - package-ecosystem: npm
-    directory: '/'
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 10
-    groups:
-      dev-dependencies:
-        dependency-type: development
-        update-types: ['minor', 'patch']
-      prod-dependencies:
-        dependency-type: production
-        update-types: ['minor', 'patch']
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..2e2ef59
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,56 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitsDisabled"
+  ],
+  "timezone": "Etc/UTC",
+  "schedule": ["before 9am on monday"],
+  "dependencyDashboard": true,
+  "labels": ["dependencies"],
+  "prConcurrentLimit": 10,
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 9am on monday"]
+  },
+  "packageRules": [
+    {
+      "description": "Group all GitHub Actions bumps into one PR.",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "Group non-major dev dependency bumps.",
+      "matchDepTypes": ["devDependencies"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "dev-dependencies"
+    },
+    {
+      "description": "Group non-major prod dependency bumps.",
+      "matchDepTypes": ["dependencies"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "prod-dependencies"
+    },
+    {
+      "description": "Group non-major pnpm catalog toolchain bumps (oxlint, oxfmt, typescript, @types/node).",
+      "matchFileNames": ["pnpm-workspace.yaml"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "catalog toolchain"
+    },
+    {
+      "description": "Automerge low-risk updates once required checks pass.",
+      "matchUpdateTypes": ["digest", "pin", "patch"],
+      "automerge": true
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Bump the waza CLI version in the eval workflow. NOTE: WAZA_SHA256 is not auto-updated; refresh it by hand or the eval job's `sha256sum -c` guard will (safely) fail the PR.",
+      "managerFilePatterns": ["/^\\.github/workflows/eval\\.yml$/"],
+      "matchStrings": ["WAZA_VERSION:\\s*(?<currentValue>v[\\d.]+)"],
+      "depNameTemplate": "microsoft/waza",
+      "datasourceTemplate": "github-releases"
+    }
+  ]
+}

From d36d27c0a81f289c903401a167c81b4920447d24 Mon Sep 17 00:00:00 2001
From: Marco Comi <9998393+kin0992@users.noreply.github.com>
Date: Wed, 3 Jun 2026 23:54:09 +0200
Subject: [PATCH 2/2] Format

---
 renovate.json | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/renovate.json b/renovate.json
index 2e2ef59..ad6051c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,9 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":semanticCommitsDisabled"
-  ],
+  "extends": ["config:recommended", ":semanticCommitsDisabled"],
   "timezone": "Etc/UTC",
   "schedule": ["before 9am on monday"],
   "dependencyDashboard": true,