chore: Configure Renovate

.github/renovate.json5

@@ -0,0 +1,99 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'config:recommended',
+    ':gitSignOff',
+    ':dependencyDashboard',
+    'helpers:pinGitHubActionDigests',
+  ],
+  prHourlyLimit: 8,
+  prConcurrentLimit: 5,
+  schedule: [
+    'before 6am on monday',
+  ],
+  vulnerabilityAlerts: {
+    enabled: true,
+    schedule: [
+      'at any time',
+    ],
+    labels: [
+      'kind/security',
+      'release-blocker',
+      'release-note/security',
+    ],
+  },
+  stopUpdatingLabel: "renovate/stop-updating",
+  keepUpdatedLabel: "renovate/keep-updated",
+  baseBranchPatterns: [
+    'main',
+  ],
+  postUpdateOptions: [
+    'gomodTidy',
+  ],
+  packageRules: [
+    {
+      groupName: 'all go module dependencies',
+      matchFileNames: [
+        'go.mod',
+        'go.sum',
+      ],
+      matchUpdateTypes: [
+        'major',
+        'minor',
+        'digest',
+        'patch',
+        'pin',
+        'pinDigest',
+      ],
+      labels: [
+        'area/vendor',
+        'enhancement',
+        'release-note/misc',
+      ],
+    },
+    {
+      groupName: 'all github action dependencies',
+      matchFileNames: [
+        '.github/workflows/**',
+      ],
+      matchUpdateTypes: [
+        'major',
+        'minor',
+        'digest',
+        'patch',
+        'pin',
+        'pinDigest',
+      ],
+      labels: [
+        'area/github-actions',
+        'enhancement',
+        'release-note/ci',
+      ],
+    },
+    {
+      groupName: 'Go',
+      matchDepNames: [
+        'docker.io/library/golang',
+        'library/golang',
+        'go',
+        'golang',
+      ],
+      addLabels: [
+        'area/build',
+        'release-note/misc',
+      ],
+    },
+  ],
+  customManagers: [
+    {
+      customType: "regex",
+      description: "Match dependencies in github actions/workflows, with support for overriding the registryUrl, and extractVersion",
+      managerFilePatterns: [
+        "/^.github/(?:workflows|actions|pr_deployment)/.+\\.ya?ml$/",
+      ],
+      matchStrings: [
+        "# renovate: datasource=(?<datasource>.+?) depName=(?<depName>.+?)(?: packageName=(?<packageName>.+?))?(?: registryUrl=(?<registryUrl>.+?))?(?: depType=(?<depType>.+?))?(?: extractVersion=(?<extractVersion>.+?))?(?: versioning=(?<versioning>.+?))?\\s+.+?:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s(.+?:\\s*[\"']?(?<currentDigest>sha256:[a-f0-9]+)[\"']?\\s)?",
+      ],
+    },
+  ],
+}

.github/workflows/tests.yml

@@ -19,16 +19,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Install Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
       with:
         go-version: ${{ matrix.go-version }}
     - name: Checkout code
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Run static checks
-      uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601
+      uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601 # v9.1.0
       with:
-        version: v2.5.0
-        # use our .golangci.yml
+        # renovate: datasource=github-releases depName=golangci/golangci-lint
+        version: v2.6.2
         args: --config=.golangci.yml --verbose
         skip-cache: true
     - name: Build