Investigate Renovate integration with `uv.lock`

[dangotbanned]

Description

(Split out from #3608)

We currently have a pre-commit autoupdate, but following #3608 - we might want that to work differently

narwhals/.pre-commit-config.yaml

Lines 1 to 2 in c3a512c

	ci:
	autoupdate_schedule: monthly

Related

• https://docs.renovatebot.com/
• chore: Adopt uv as package manager #3608 (comment)
• https://github.com/ibis-project/ibis/blob/eb94a64f7e1fb614ece94dd3b61b3ba0454d0de9/.github/renovate.json

[FBruzzesi]

I tried to gather a step-by-step action plan:

1. Enable Renovate on the repo by installing the Mend Renovate GitHub App. This should open an onboarding PR.
2. Add .github/renovate.json (config below).
3. Dry-run / validate before merging (two complementary checks):
   a. Validate config syntax with renovate-config-validator (run via npx renovate-config-validator): config validation docs.
   b. (Optional?): Preview what it would do without opening PRs, using the self-hosted dryRun option (set to "full" to simulate branch/PR creation via logs): dryRun docs. This needs a one-off self-hosted run (e.g. npx renovate --dry-run=full --token=...), since the hosted app does not expose dry-run.
4. Verify the first PR touches only uv.lock and nothing is changed on pyproject.toml (no bumped lower bound, no added upper cap, etc).

Tip

If I understand correctly, the hosted app run on a hourly-ish basis, if that's too frequent and/or generates too much noise, we can add a schedule. Once a day might be more than fine

.github/renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":dependencyDashboard"],
  "rangeStrategy": "update-lockfile",
  "enabledManagers": ["pep621"],
  "labels": ["dependencies"],
  "packageRules": [
    {
      "description": "Never propose updates for the workspace package itself",
      "matchPackageNames": ["narwhals", "test-plugin"],
      "enabled": false
    },
    {
      "description": "Group all uv.lock bumps into one PR to cut noise",
      "matchManagers": ["pep621"],
      "groupName": "uv.lock dependencies"
    }
  ]
}

References for values in the json manifest:

• "rangeStrategy": "update-lockfile":

  • https://docs.renovatebot.com/configuration-options/#rangestrategy
  • Goal is to bump the resolved version inside uv.lock only, never edit the pyproject.toml to keep lowest pin intact and avoid introducing any upper cap directly

• "enabledManagers": ["pep621"]:

  • enabledManagers
  • pep621 manager