ci: add Renovate

.github/workflows/renovate.yml

@@ -0,0 +1,30 @@
+name: Renovate update dependencies
+on:
+  schedule:
+    # UTC 10:00 PM Sunday - Thursday (AEST 8:00 AM, Monday - Friday)
+    - cron: "0 22 * * 0-4"
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Dry run"
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Renovate
+        uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
+        with:
+          configurationFile: renovate-config.js
+          token: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
+        env:
+          RENOVATE_DRY_RUN: ${{ inputs.dry-run && 'full' || null }}

renovate-config.js

@@ -0,0 +1,43 @@
+module.exports = {
+  platform: 'github',
+  timezone: 'Australia/Brisbane',
+  requireConfig: 'optional',
+  onboarding: false,
+
+  repositories: ['OctopusDeploy/openfeature-provider-java'],
+  reviewers: ['team:team-devex'],
+  branchPrefix: 'renovate/',
+
+  // Limit concurrent PRs for better manageability
+  prConcurrentLimit: 5,
+
+  // Add labels to PRs
+  labels: ['dependencies'],
+
+  // Wait until a release has been published for at least 2 days before updating,
+  // to avoid picking up versions that get yanked or hotfixed shortly after release.
+  minimumReleaseAge: '2 days',
+
+  // Enable vulnerability alerts
+  osvVulnerabilityAlerts: true,
+
+  // Produce conventional-commit PR titles so validate-pr-title passes
+  semanticCommits: 'enabled',
+
+  // Extend with recommended config
+  extends: ['config:recommended'],
+
+  // Only manage Maven deps and GitHub Actions (leaves the `specification` submodule alone)
+  enabledManagers: ['maven', 'github-actions'],
+
+  packageRules: [
+    {
+      // GitHub Actions: pin third-party actions to a commit SHA for security.
+      matchManagers: ['github-actions'],
+      matchPackageNames: [
+        '!actions/**', // Trust official GitHub actions (checkout, setup-java, etc.); don't pin.
+      ],
+      pinDigests: true,
+    },
+  ],
+};