ci: add renovate configuration

[slauger]

Add renovate for automated dependency management.

• Go modules (grouped)
• GitHub Actions (with digest pinning)
• Docker base images
• Go version tracking in workflow files via custom regex manager

Related: #118 #120

[slauger]

idk if Renovate is already enabled for this repository - @bastelfreak?

FYI @jay7x

[jay7x]

Shall we disable dependabot then also?

[slauger]

I considered removing dependabot directly, but first I wanted to see if Renovate actually creates MRs.

[jay7x]

As I see here gorge repository is not enabled. IIRC I asked @bastelfreak to enable it for puppet-caddy repo last time.

[slauger]

Maybe we can grant the mend app access to the whole organization? In that case we would just need to add a renovate.json in the repository to enable renovate. At least this is how other orgs on GitHub handle things.

[TheMeier]

why back to renovate?

#82

[slauger]

why back to renovate?

#82

Sorry, the notification for this slipped through.

Dependabot handles some basics like Go module updates, but it doesn't cover all cases. For example, it can't track the Go version used in workflow files (e.g. go-version in .github/workflows/*.yml) or handle digest pinning for GitHub Actions.

The Renovate config in this PR also groups Go module updates into a single PR instead of creating one per dependency, which reduces noise quite a bit.

Other voxpupuli repos are also moving forward to Renovate.