chore: migrate npm/github-actions/docker-compose from Renovate to Dependabot

.github/dependabot.yml

@@ -0,0 +1,69 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    versioning-strategy: increase
+    commit-message:
+      prefix: chore
+      include: scope
+    cooldown:
+      default-days: 2
+    groups:
+      production-non-major:
+        dependency-type: production
+        update-types:
+          - patch
+          - minor
+      development-non-major:
+        dependency-type: development
+        update-types:
+          - patch
+          - minor
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: chore
+    cooldown:
+      default-days: 2
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker-compose
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Tokyo
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: chore
+    cooldown:
+      default-days: 2
+    ignore:
+      - dependency-name: s0hirano/embedding-api
+    groups:
+      docker-compose:
+        patterns:
+          - "*"

.github/renovate.json5

@@ -14,20 +14,22 @@
   reviewers: [
     's-hirano-ist',
   ],
+  // Dependabot がサポートしない範囲のみ Renovate で扱う:
+  //   - mise / nvm: ツールバージョン管理
+  //   - biome customManager: extends の customManagers:biomeVersions が拾う
+  //   - lockFileMaintenance: 四半期に pnpm-lock 全リフレッシュ
+  // npm / github-actions / docker-compose は .github/dependabot.yml に移行済み。
   enabledManagers: [
-    'npm',
-    'github-actions',
-    'docker-compose',
     'mise',
     'nvm',
   ],
-  // Mend Cloud で pnpm install の lifecycle scripts (sharp / @prisma/engines /
-  // @sentry/cli / esbuild) がメモリを使い切り OOM kill される問題への対処。
+  // Mend Cloud / self-host いずれでも pnpm install の lifecycle scripts (sharp /
+  // @prisma/engines / @sentry/cli / esbuild) によるメモリ消費を抑える保険。
   // CI (--frozen-lockfile) と本番 deploy 側の install では通常通りバイナリを取得する。
   ignoreScripts: true,
   dependencyDashboard: true,
-  branchConcurrentLimit: 3,
-  prConcurrentLimit: 5,
+  branchConcurrentLimit: 2,
+  prConcurrentLimit: 2,
   separateMultipleMajor: false,
   schedule: [
     'before 11am on monday',
@@ -49,52 +51,6 @@
     ],
   },
   packageRules: [
-    {
-      matchManagers: [
-        'npm',
-      ],
-      matchUpdateTypes: [
-        'patch',
-        'minor',
-      ],
-      matchPackageNames: [
-        '*',
-      ],
-      matchDepTypes: [
-        'dependencies',
-        'peerDependencies',
-      ],
-      groupName: 'non-major',
-      minimumReleaseAge: '2 days',
-    },
-    {
-      matchManagers: [
-        'npm',
-      ],
-      matchUpdateTypes: [
-        'patch',
-        'minor',
-      ],
-      matchPackageNames: [
-        '*',
-      ],
-      matchDepTypes: [
-        'devDependencies',
-      ],
-      groupName: 'non-major (devDependencies)',
-      groupSlug: 'non-major-dev',
-      minimumReleaseAge: '2 days',
-      automerge: true,
-    },
-    {
-      matchManagers: [
-        'github-actions',
-      ],
-      groupName: 'GitHub Actions',
-      groupSlug: 'github-actions',
-      minimumReleaseAge: '2 days',
-      automerge: true,
-    },
     {
       matchManagers: [
         'mise',
@@ -111,29 +67,12 @@
       ],
       matchManagers: [
         'mise',
-        'npm',
         'nvm',
       ],
       groupName: 'node and pnpm',
       groupSlug: 'node-pnpm',
       minimumReleaseAge: '2 days',
       automerge: false,
     },
-    {
-      matchManagers: [
-        'docker-compose',
-      ],
-      minimumReleaseAge: '2 days',
-      automerge: true,
-    },
-    {
-      matchManagers: [
-        'docker-compose',
-      ],
-      matchPackageNames: [
-        's0hirano/embedding-api',
-      ],
-      enabled: false,
-    },
   ],
 }

.github/workflows/dependabot-auto-merge.yaml

@@ -0,0 +1,38 @@
+name: dependabot-auto-merge
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions: {}
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+
+      - name: Enable auto-merge for low-risk updates
+        # Renovate 旧設定相当:
+        #   - devDependencies (npm) の patch/minor: automerge
+        #   - github-actions の patch/minor: automerge
+        #   - docker-compose の patch/minor: automerge
+        # production deps と major は手動レビュー (auto-merge しない)。
+        if: |
+          steps.meta.outputs.update-type != 'version-update:semver-major' && (
+            (steps.meta.outputs.package-ecosystem == 'npm' &&
+              steps.meta.outputs.dependency-type == 'direct:development') ||
+            steps.meta.outputs.package-ecosystem == 'github_actions' ||
+            steps.meta.outputs.package-ecosystem == 'docker_compose'
+          )
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}