Add renovate

Author: danharrin

.github/dependabot.yml

@@ -1,6 +1,5 @@
 version: 2
 updates:
-  # ---------- 4.x (default branch) ----------
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -10,63 +9,8 @@ updates:
       default-days: 7
     labels:
       - dependencies
-      - github_actions
     milestone: 9
 
-  # composer / npm blocks use open-pull-requests-limit: 0 so dependabot opens
-  # security-update PRs only (driven by GitHub security advisories). Version
-  # updates are disabled — security PRs still inherit labels/milestone from here.
-  - package-ecosystem: composer
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - composer
-    milestone: 9
-
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 9
-
-  - package-ecosystem: composer
-    directory: /docs-assets/app
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - composer
-    milestone: 9
-
-  - package-ecosystem: npm
-    directory: /docs-assets/app
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 9
-
-  - package-ecosystem: npm
-    directory: /docs-assets/screenshots
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 9
-
-  # ---------- 5.x ----------
   - package-ecosystem: github-actions
     directory: /
     target-branch: 5.x
@@ -77,65 +21,8 @@ updates:
       default-days: 7
     labels:
       - dependencies
-      - github_actions
-    milestone: 10
-
-  - package-ecosystem: composer
-    directory: /
-    target-branch: 5.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - composer
-    milestone: 10
-
-  - package-ecosystem: npm
-    directory: /
-    target-branch: 5.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 10
-
-  - package-ecosystem: composer
-    directory: /docs-assets/app
-    target-branch: 5.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - composer
-    milestone: 10
-
-  - package-ecosystem: npm
-    directory: /docs-assets/app
-    target-branch: 5.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 10
-
-  - package-ecosystem: npm
-    directory: /docs-assets/screenshots
-    target-branch: 5.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
     milestone: 10
 
-  # ---------- 3.x ----------
   - package-ecosystem: github-actions
     directory: /
     target-branch: 3.x
@@ -146,60 +33,16 @@ updates:
       default-days: 7
     labels:
       - dependencies
-      - github_actions
     milestone: 2
 
-  - package-ecosystem: composer
-    directory: /
-    target-branch: 3.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - composer
-    milestone: 2
-
-  - package-ecosystem: npm
+  - package-ecosystem: github-actions
     directory: /
-    target-branch: 3.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 2
-
-  - package-ecosystem: composer
-    directory: /docs-assets/app
-    target-branch: 3.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - composer
-    milestone: 2
-
-  - package-ecosystem: npm
-    directory: /docs-assets/app
-    target-branch: 3.x
+    target-branch: 2.x
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0
-    labels:
-      - dependencies
-      - javascript
-    milestone: 2
-
-  - package-ecosystem: npm
-    directory: /docs-assets/screenshots
-    target-branch: 3.x
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 0
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     labels:
       - dependencies
-      - javascript
-    milestone: 2
+    milestone: 1

.github/workflows/renovate.yml

@@ -0,0 +1,30 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: '0 3 * * *'   # daily, 03:00 UTC
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: 'Dry run (log only, open no PRs)'
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
+        env:
+          RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_DRY_RUN: ${{ inputs.dryRun && 'full' || '' }}
+          LOG_LEVEL: ${{ inputs.dryRun && 'debug' || 'info' }}

renovate.json

@@ -0,0 +1,17 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["config:recommended"],
+    "enabledManagers": ["composer", "npm"],
+    "baseBranchPatterns": ["5.x", "4.x", "3.x"],
+    "osvVulnerabilityAlerts": true,
+    "vulnerabilityAlerts": {
+        "enabled": true,
+        "labels": ["dependencies"]
+    },
+    "packageRules": [
+        { "matchPackageNames": ["*"], "enabled": false }
+    ],
+    "onboarding": false,
+    "requireConfig": "optional",
+    "dependencyDashboard": true
+}