build(deps): renovate replaces dependabot here too

.github/workflows/pr-title.yml

@@ -16,13 +16,13 @@ permissions:
 jobs:
   lint:
     name: Lint the title
-    # Dependabot's pull requests do run workflows, unlike release-please's, so
+    # Renovate's pull requests do run workflows, unlike release-please's, so
     # they reach this job. Its titles are conventional by construction — the
-    # prefixes are pinned in dependabot.yml — but the subject's leading "bump"
-    # has been capitalised on some runs and not others, and the title cannot be
-    # edited to fix it. Linting it can only produce red nobody can clear.
+    # type comes from `semanticCommitType` in renovate.json — and a title it
+    # rewrites on the next run cannot be corrected by hand. Linting it can only
+    # produce red nobody can clear.
     if: >-
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
+      github.event.pull_request.user.login != 'renovate[bot]' &&
       github.head_ref != 'release-please--branches--main' &&
       github.head_ref != 'chore/spec-sync'
     runs-on: ubuntu-latest

SECURITY.md

@@ -14,7 +14,7 @@ concerns are narrow, and worth naming:
 - **Supply chain.** Every GitHub Action is pinned by commit SHA, and `oasdiff`
   runs from a digest-pinned container. That pin matters more than it looks:
   `oasdiff` decides published version numbers, so a silently-changed classifier
-  could ship a breaking change as a patch. Dependabot proposes updates only
+  could ship a breaking change as a patch. Renovate proposes updates only
   after a release has been on its registry for **seven days**, leaving time for
   a compromised version to be yanked before it reaches a pull request.
 - **Credential handling.** The clients take a bot token and send it as an

docs/versioning.md

@@ -152,5 +152,5 @@ classification, then update the list in the same commit.
 
 The spec is not the only thing that can break a consumer. A generator upgrade
 can rename a model or change a method signature without the spec moving at all.
-Those changes arrive through ordinary Dependabot pull requests and need a human
+Those changes arrive through ordinary Renovate pull requests and need a human
 to write the conventional commit — the automation has no view into them.

renovate.json

@@ -0,0 +1,115 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommits",
+    ":dependencyDashboard"
+  ],
+  "timezone": "Europe/Amsterdam",
+  "schedule": [
+    "before 06:00 on monday"
+  ],
+  "minimumReleaseAge": "7 days",
+  "labels": [
+    "dependencies"
+  ],
+  "prConcurrentLimit": 8,
+  "branchConcurrentLimit": 8,
+  "rebaseWhen": "conflicted",
+  "semanticCommitType": "build",
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "before 05:00 on monday"
+    ]
+  },
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": [
+      "dependencies",
+      "bug"
+    ]
+  },
+  "packageRules": [
+    {
+      "description": "A major bump needs code changes, so it never joins a group. Dashboard approval keeps it out of the queue until someone picks it up.",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "The spec pipeline decides release version numbers, so its updates are reviewed on their own rather than alongside the client's.",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "tools/**"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "groupName": "spec pipeline",
+      "addLabels": [
+        "javascript"
+      ]
+    },
+    {
+      "matchManagers": [
+        "npm"
+      ],
+      "matchFileNames": [
+        "typescript/**"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "groupName": "typescript client",
+      "addLabels": [
+        "javascript"
+      ]
+    },
+    {
+      "matchManagers": [
+        "gradle",
+        "gradle-wrapper"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "groupName": "kotlin client",
+      "addLabels": [
+        "java"
+      ]
+    },
+    {
+      "description": "Every action is pinned by commit SHA, so Renovate keeps the digest and the version comment in step. Nothing in CI exercises release.yml, so an Actions major that breaks releasing goes in green — check it by hand after one lands.",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "pinDigests": true,
+      "groupName": "github actions dependencies",
+      "addLabels": [
+        "github_actions"
+      ]
+    },
+    {
+      "description": "CodeQL's Kotlin extractor refuses a compiler it does not know, and the analysis builds the client to scan it: `Kotlin version 2.4.20 is too recent. CodeQL currently supports versions below 2.4.20`. The bump cannot go green until the extractor catches up, and an open pull request that never can only hides the ones that can. Lift this once CodeQL supports 2.4.20.",
+      "matchPackageNames": [
+        "org.jetbrains.kotlin.jvm",
+        "/^org\\.jetbrains\\.kotlin[.:]/"
+      ],
+      "allowedVersions": "<2.4.20"
+    },
+    {
+      "description": "TypeScript 7 is the native port and reshaped the compiler API. It removes what @hey-api/openapi-ts reads at import time, so the generator dies before it emits anything: TypeError: Cannot read properties of undefined (reading 'AnyKeyword'). Lift this once openapi-ts declares support for typescript 7.",
+      "matchPackageNames": [
+        "typescript"
+      ],
+      "allowedVersions": "<7"
+    }
+  ]
+}