chor: Renovate対応

.github/dependabot.yml

@@ -1,12 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for more information:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-# https://containers.dev/guide/dependabot
-
-version: 2
-updates:
- - package-ecosystem: "devcontainers"
-   directory: "/"
-   schedule:
-     interval: weekly

.github/workflows/renovate.yaml

@@ -0,0 +1,20 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: "@daily"
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: renovate
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_CONFIG: ${{ vars.RENOVATE_CONFIG }}

renovate.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "timezone": "Asia/Tokyo",
+  "schedule": [
+    "after 9am and before 5pm every weekday"
+  ],
+  "labels": ["dependencies"],
+  "assignees": ["aoikamishiro"],
+  "packageRules": [
+    {
+      "description": "マイナー・パッチアップデートの自動マージ",
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash"
+    },
+    {
+      "description": "メジャーアップデートは手動レビュー",
+      "matchUpdateTypes": ["major"],
+      "automerge": false
+    },
+    {
+      "description": "開発依存関係のグループ化",
+      "matchDepTypes": ["devDependencies"],
+      "groupName": "開発依存関係"
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "labels": ["security"],
+    "assignees": ["aoikamishiro"]
+  }
+}