ci: switch Renovate to the shared team config (#88)

Author: desruc

.github/actions/build-test-pack-deploy/action.yml

@@ -89,20 +89,20 @@ runs:
 
     - name: Login to Octopus Deploy
       if: github.event.pull_request.head.repo.fork != true && (! contains(github.ref, '/dependabot/'))
-      uses: OctopusDeploy/login@5e2331a069ebc144b20ded22766dfce025dd9e73 # v2
+      uses: OctopusDeploy/login@v2
       with:
         server: ${{ inputs.octopus-url }}
         service_account_id: 42e00747-07e1-4214-979c-af3381e6d951
 
     - name: Push to Octopus
-      uses: OctopusDeploy/push-package-action@88c472a064af6485c4d0cc07d587213895a74a2e # v4
+      uses: OctopusDeploy/push-package-action@v4
       if: github.event.pull_request.head.repo.fork != true && (! contains(github.ref, '/dependabot/'))
       with:
         packages: |
           ${{ steps.bundle.outputs.path }}
 
     - name: Create Release in Octopus
-      uses: OctopusDeploy/create-release-action@2fceebb1d9cc8624d726a77e2faf93948de6741d # v4
+      uses: OctopusDeploy/create-release-action@v4
       if: github.event.pull_request.head.repo.fork != true && (! contains(github.ref, '/dependabot/'))
       with:
         project: "OpenFeature Java Provider"

.github/workflows/renovate-approve.yml

@@ -0,0 +1,9 @@
+name: Renovate approve
+on:
+  pull_request:
+    types: [synchronize, auto_merge_enabled]
+jobs:
+  renovate-approve:
+    uses: OctopusDeploy/team-bmbb-renovate-config/.github/workflows/renovate-approve.yml@main
+    permissions:
+      pull-requests: write

.github/workflows/renovate.yml

@@ -1,30 +1,13 @@
-name: Renovate update dependencies
+name: Renovate
 on:
   schedule:
-    # UTC 10:00 PM Sunday - Thursday (AEST 8:00 AM, Monday - Friday)
-    - cron: "0 22 * * 0-4"
+    - cron: "0 3 * * 1-5"
+      timezone: Australia/Brisbane
   workflow_dispatch:
-    inputs:
-      dry-run:
-        description: "Dry run"
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: read
-
 jobs:
   renovate:
-    name: Renovate
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Renovate
-        uses: renovatebot/github-action@6d26fcf0275dc65624cbc3d51fe78bc773f98321 # v46.3.6
-        with:
-          configurationFile: renovate-config.js
-          token: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
-        env:
-          RENOVATE_DRY_RUN: ${{ inputs.dry-run && 'full' || null }}
+    uses: OctopusDeploy/team-bmbb-renovate-config/.github/workflows/renovate.yml@main
+    permissions:
+      contents: read
+    secrets:
+      RENOVATE_GITHUB_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}

renovate-config.js

@@ -1,32 +1,9 @@
 module.exports = {
-  platform: 'github',
-  timezone: 'Australia/Brisbane',
-  requireConfig: 'optional',
-  onboarding: false,
-
-  repositories: ['OctopusDeploy/openfeature-provider-java'],
-  reviewers: ['team:team-devex'],
-  branchPrefix: 'renovate/',
-
-  // Limit concurrent PRs for better manageability
-  prConcurrentLimit: 5,
-
-  // Add labels to PRs
-  labels: ['dependencies'],
-
-  // Wait until a release has been published for at least 2 days before updating,
-  // to avoid picking up versions that get yanked or hotfixed shortly after release.
-  minimumReleaseAge: '2 days',
-
-  // Enable vulnerability alerts
-  osvVulnerabilityAlerts: true,
+  extends: ['github>OctopusDeploy/team-bmbb-renovate-config:default.json5'],
 
   // Produce conventional-commit PR titles so validate-pr-title passes
   semanticCommits: 'enabled',
 
-  // Extend with recommended config
-  globalExtends: ['config:recommended'],
-
   // Only manage Maven deps and GitHub Actions (leaves the `specification` submodule alone)
   enabledManagers: ['maven', 'github-actions'],
 
@@ -37,24 +14,5 @@ module.exports = {
       matchUpdateTypes: ['minor', 'patch'],
       semanticCommitType: 'feat',
     },
-    {
-      // GitHub Actions: pin third-party actions to a commit SHA for security.
-      matchManagers: ['github-actions'],
-      matchPackageNames: [
-        '!actions/**', // Trust official GitHub actions (checkout, setup-java, etc.); don't pin.
-      ],
-      pinDigests: true,
-    },
-    {
-      // pin/pinDigest/digest updates have no release timestamp, so
-      // minimumReleaseAge can never be satisfied and its stability check
-      // would leave those PRs pending forever.
-      // https://github.com/renovatebot/renovate/issues/40288
-      matchUpdateTypes: ['pin', 'pinDigest', 'digest'],
-      minimumReleaseAge: null,
-      prBodyNotes: [
-        '**Manual supply-chain check:** `minimumReleaseAge` cannot be enforced for pin/digest updates because they have no release timestamp. Before merging, confirm this commit SHA has been published for at least **2 days**.',
-      ],
-    },
   ],
 };