ci: switch dependency updates from Dependabot to Renovate

Author: emilyoram

.github/dependabot.yml

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)"
+  ],
+  "semanticCommits": "enabled",
+  "baseBranchPatterns": ["main", "stable/8.8"],
+  "rebaseWhen": "behind-base-branch",
+  "packageRules": [
+    {
+      "description": "Group all npm updates into a single PR (mirrors Dependabot's npm-dependencies group).",
+      "matchManagers": ["npm"],
+      "groupName": "npm dependencies"
+    },
+    {
+      "description": "Group GitHub Actions updates into a single PR.",
+      "matchManagers": ["github-actions"],
+      "groupName": "github actions"
+    },
+    {
+      "description": "Never auto-bump the orchestration API client across majors.",
+      "matchPackageNames": ["@camunda8/orchestration-cluster-api"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
+    {
+      "description": "Auto-merge minor updates once CI is green.",
+      "matchUpdateTypes": ["minor"],
+      "automerge": true
+    }
+  ],
+  "vulnerabilityAlerts": { "enabled": false }
+}

.github/renovate.json

@@ -61,7 +61,7 @@ Note the **mutated semver**: `feat`/`fix` produce **patch** bumps, not minor/maj
 
 ### Common pitfalls
 
-- **`deps:` is not valid.** Use `chore(deps): ...` for dependency pinning / bumps. (Dependabot itself uses `chore(deps):`.)
+- **`deps:` is not valid.** Use `chore(deps): ...` for dependency pinning / bumps. (Renovate is configured to use `chore(deps):` as well.)
 - The pre-commit Husky hook runs `npm run test`, which can fail on local-only files (e.g. nested worktrees). The release workflow bypasses this with `HUSKY=0`. For agent commits that are otherwise validated, prefix with `HUSKY=0` rather than `--no-verify`.
 
 ---

AGENT.md

@@ -33,7 +33,7 @@ When a new Camunda minor (e.g. `8.9`) is ready to be promoted to `latest`:
 2. Update the GitHub **repository variable** (Settings → Secrets and variables → Actions → Variables) `CAMUNDA_SDK_CURRENT_STABLE_MINOR` from `8.8` to `8.9`.
 3. The next merge to `stable/8.9` will publish to npm dist-tag `latest`. The previous current line (`stable/8.8`) automatically falls back to maintenance dist-tag `8.8-stable` on its next release.
 4. Update [.github/workflows/integration-test-matrix-trigger.yaml](.github/workflows/integration-test-matrix-trigger.yaml) to add a daily compatibility-test trigger for the new branch (uncomment / duplicate the `trigger-stable-8-9` block).
-5. Update [.github/dependabot.yml](.github/dependabot.yml) `target-branch` entries if the previous stable line should be replaced as a dependabot target.
+5. Update [.github/renovate.json](.github/renovate.json) `baseBranchPatterns` if the previous stable line should be replaced as a Renovate target.
 
 No git tag manipulation is required — semantic-release reads existing tags and computes the next version per branch independently.