[deps] Replace Dependabot with Renovate

.buildkite/pull-requests.json

@@ -4,7 +4,7 @@
         "pipeline_slug": "fleet-server",
         "allow_org_users": true,
         "allowed_repo_permissions": ["admin", "write"],
-        "allowed_list": ["dependabot[bot]", "mergify[bot]", "github-actions[bot]"],
+        "allowed_list": ["dependabot[bot]", "elastic-renovate-prod[bot]", "mergify[bot]", "github-actions[bot]"],
         "set_commit_status": true,
         "build_on_commit": true,
         "build_on_comment": true,
@@ -18,7 +18,7 @@
         "pipeline_slug": "fleet-server-package-mbp",
         "allow_org_users": true,
         "allowed_repo_permissions": ["admin", "write"],
-        "allowed_list": ["dependabot[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
+        "allowed_list": ["dependabot[bot]", "elastic-renovate-prod[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
         "set_commit_status": false,
         "build_on_commit": false,
         "build_on_comment": true,
@@ -31,7 +31,7 @@
         "pipeline_slug": "fleet-server-perf-tests",
         "allow_org_users": true,
         "allowed_repo_permissions": ["admin", "write"],
-        "allowed_list": ["dependabot[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
+        "allowed_list": ["dependabot[bot]", "elastic-renovate-prod[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
         "set_commit_status": false,
         "build_on_commit": false,
         "build_on_comment": true,

.github/workflows/post-dependabot.yml → .github/workflows/post-dependency-update.yml

@@ -1,13 +1,14 @@
-# Follow-on actions relating to dependabot PRs. In elastic/fleet-server, any changes to
-# dependencies contained in go.mod requires the change to be reflected in the
-# NOTICE.txt file. When dependabot creates a branch for a go_modules change this
-# will update the NOTICE.txt file for that change.
-name: post-dependabot
+# Follow-on actions for dependency update PRs (Dependabot and Renovate). In
+# elastic/fleet-server, changes to dependencies in go.mod require NOTICE.txt and
+# NOTICE-fips.txt to be updated. This workflow applies those follow-on changes to
+# the dependency update branch.
+name: post-dependency-update
 
 on:
   push:
     branches:
       - 'dependabot/go_modules/**'
+      - 'renovate/*golang/**'
 
 permissions:
   contents: read
@@ -42,9 +43,9 @@ jobs:
       - name: commit modified files
         if: steps.check-files.outputs.modified == 'true'
         run: |
-          git config --global user.name 'dependabot[bot]'
-          git config --global user.email 'dependabot[bot]@users.noreply.github.com'
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
           git add NOTICE.txt NOTICE-fips.txt testing/go.mod testing/go.sum
           git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
-          git commit -m "Post dependabot file modifications"
+          git commit -m "Post dependency update file modifications"
           git push

.github/workflows/update-renovate-branches.yml

@@ -0,0 +1,59 @@
+---
+name: update-renovate-branches
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+env:
+  JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - id: generator
+        uses: elastic/oblt-actions/elastic/active-branches@v1
+        with:
+          filter-branches: true
+
+      - uses: actions/checkout@v7
+
+      - name: Update baseBranchPatterns in renovate.json
+        env:
+          MATRIX: ${{ steps.generator.outputs.matrix }}
+        run: |
+          branches=$(printf '%s' "$MATRIX" | jq -c '[.include[].branch]')
+          jq --argjson branches "$branches" '.baseBranchPatterns = $branches' \
+            renovate.json > renovate.json.new
+          mv renovate.json.new renovate.json
+
+      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "[Automation] Update Renovate base branches to current active branches"
+          title: "[Automation] Update Renovate base branches to current active branches"
+          body: |
+            Updates `baseBranchPatterns` in `renovate.json` to match the current set of active release branches queried from the Elastic release schedule.
+          branch: update-renovate-branches
+          base: main
+          delete-branch: true
+          labels: |
+            automation
+            skip-changelog
+            backport-skip
+            Team:Elastic-Agent-Control-Plane
+
+      - if: ${{ failure() }}
+        uses: elastic/oblt-actions/slack/send@v1
+        with:
+          bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
+          channel-id: "#fleet-notifications"
+          message: ":traffic_cone: Renovate branches update failed for `${{ github.repository }}`, @fleet_team please look what's going on <${{ env.JOB_URL }}|here>"

renovate.json

@@ -0,0 +1,72 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "dependencyDashboard": true,
+  "enabledManagers": ["gomod", "github-actions", "pre-commit"],
+  "baseBranchPatterns": ["main", "9.5", "9.4", "9.3", "8.19"],
+  "labels": [
+    "automation",
+    "dependency",
+    "skip-changelog",
+    "backport-skip",
+    "Team:Elastic-Agent-Control-Plane"
+  ],
+  "pre-commit": {
+    "enabled": true
+  },
+  "packageRules": [
+    {
+      "description": "Go modules: schedule, PR limit, and branch prefix",
+      "matchManagers": ["gomod"],
+      "additionalBranchPrefix": "golang/",
+      "schedule": ["on monday"],
+      "prConcurrentLimit": 10
+    },
+    {
+      "description": "go-dependencies: catch-all group for Go modules not claimed by a more specific group",
+      "matchManagers": ["gomod"],
+      "groupName": "go-dependencies"
+    },
+    {
+      "description": "elastic: all Elastic org packages",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": [
+        "/^github\\.com/elastic//",
+        "/^go\\.elastic\\.co//"
+      ],
+      "groupName": "elastic"
+    },
+    {
+      "description": "test-tooling: dependencies used for tests and test infrastructure",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": [
+        "/^github\\.com/testcontainers//",
+        "/^github\\.com/Shopify//",
+        "/^github\\.com/moby//",
+        "/^github\\.com/magefile/mage$/",
+        "/^github\\.com/stretchr//"
+      ],
+      "groupName": "test-tooling"
+    },
+    {
+      "description": "GitHub Actions: grouped weekly Sunday updates",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions",
+      "schedule": ["on sunday"],
+      "prConcurrentLimit": 10
+    },
+    {
+      "description": "GitHub Actions: keep macOS runner updates manual",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["github-runner"],
+      "matchPackageNames": ["macos"],
+      "enabled": false
+    },
+    {
+      "description": "pre-commit: weekly Sunday updates",
+      "matchManagers": ["pre-commit"],
+      "schedule": ["on sunday"],
+      "addLabels": ["changelog:dependencies"],
+      "prConcurrentLimit": 5
+    }
+  ]
+}