chore(renovate): migrate off Dependabot to the fleet preset

[stranske]

Counter_Risk is the last fleet repo still on Dependabot. This completes its migration to Renovate, mirroring the other consumers (e.g. Template).

• Add .github/renovate.json → extends: ["github>stranske/Workflows//renovate-presets/fleet"] (dev-tool exclusions, grouped automerge-on-green, vendored-minimatch cascade, and the pip-compile manager that regenerates requirements.lock in-PR).
• Remove .github/dependabot.yml.

Supersedes the Renovate onboarding PR #715 (Mend's default config:recommended) — a root renovate.json would override .github/renovate.json, so the fleet preset lives in .github/. #715 will be closed once this merges.

Unblocks retiring the shared Dependabot machinery in stranske/Workflows (weekly-sweep + template auto-merge).

Summary by CodeRabbit

• Chores
  • Switched dependency management tooling from Dependabot to Renovate.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b45e7c42-300d-4956-a25d-2727da48a1ff

📥 Commits

Reviewing files that changed from the base of the PR and between ba965d0 and 2c45226.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/renovate.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

💤 Files with no reviewable changes (1)

• .github/dependabot.yml

📜 Recent review details

🧰 Additional context used

🔀 Multi-repo context stranske/Workflows

Based on my comprehensive exploration of the stranske/Workflows repository, I have gathered the necessary cross-repository context to inform this review.

Linked repositories findings

stranske/Workflows [::stranske/Workflows::]

Fleet Preset Configuration (renovate-presets/fleet.json):
The fleet preset is the authoritative source for dependency automation across all stranske/* consumer repos. Counter_Risk's .github/renovate.json correctly extends this preset with "extends": ["github>stranske/Workflows//renovate-presets/fleet"]. The preset includes:

• Grouped automerge-on-green for minor+patch updates [::stranske/Workflows::renovate-presets/fleet.json::lines 32-36]
• Dev-tool exclusions (ruff, black, mypy, pytest, etc.) that are managed through maint workflows, not Renovate [::stranske/Workflows::renovate-presets/fleet.json::lines 23-30]
• pip-compile manager to regenerate requirements.lock from the command in the lock header [::stranske/Workflows::renovate-presets/fleet.json::lines 18-20]
• Vendored npm cascade grouping for minimatch/brace-expansion/balanced-match [::stranske/Workflows::renovate-presets/fleet.json::lines 37-42]

Consumer Template Pattern (templates/consumer-repo/.github/renovate.json):
Counter_Risk's proposed .github/renovate.json matches the standard fleet consumer template exactly [::stranske/Workflows::templates/consumer-repo/.github/renovate.json::], which only extends the fleet preset without overrides.

Registered Fleet Consumers (.github/workflows/maint-68-sync-consumer-repos.yml):
Counter_Risk is listed among 13 registered fleet consumers [::stranske/Workflows::.github/workflows/maint-68-sync-consumer-repos.yml::lines 72-84]. Current Dependabot machinery targets all these repos weekly.

Dependabot Retirement Machinery [::stranske/Workflows::]:
Three workflows currently manage Dependabot across consumer repos:

• maint-dependabot-weekly-sweep.yml — Sweeps registered consumer repos (Mondays 09:00 UTC) to enable auto-merge on green for Dependabot PRs [::stranske/Workflows::.github/workflows/maint-dependabot-weekly-sweep.yml::]
• maint-dependabot-auto-lock.yml — Regenerates requirements.lock when Dependabot updates dependencies (now a backstop, since the fleet preset's pip-compile manager handles this for Renovate) [::stranske/Workflows::.github/workflows/maint-dependabot-auto-lock.yml::lines 1-15]
• maint-82-sync-dependabot-campaign.yml — Tracks Dependabot and sync PRs with active review threads [::stranske/Workflows::.github/workflows/maint-82-sync-dependabot-campaign.yml::]

Once Counter_Risk completes this migration, all fleet consumers will be on Renovate, unblocking the retirement of these shared Dependabot workflows.

Critical Dependency: The fleet preset's pip-compile manager requires requirements.lock to have a properly formatted uv pip compile header with --python-version=3.12 (equals form) [::stranske/Workflows::renovate-presets/fleet.json::lines 18-20]. If Counter_Risk's lock file doesn't match this format, Renovate won't regenerate it automatically, risking stale dependencies.

🔇 Additional comments (2)

.github/renovate.json (2)

1-4: LGTM!

---

3-3: ⚠️ Potential issue | 🔴 Critical

Fix requirements.lock header format for Renovate's pip-compile manager.

The lock file header uses --python-version 3.12 (space separator), but the fleet preset's pip-compile manager requires --python-version=3.12 (equals form). Without this exact format, Renovate won't regenerate the lock file automatically, risking stale dependencies.

Update the first two lines of requirements.lock:

Header fix

# This file was autogenerated by uv via the following command:
-#    uv pip compile --python-version 3.12 pyproject.toml --extra dev --universal --output-file requirements.lock
+#    uv pip compile --python-version=3.12 pyproject.toml --extra dev --universal --output-file requirements.lock

Dependabot removal and Renovate configuration are correct.

			> Likely an incorrect or invalid review comment.

Source: MCP tools

---

📝 Walkthrough

Walkthrough

Removes the existing .github/dependabot.yml file (which configured weekly Dependabot updates for pip and GitHub Actions with several ignored dev-tool packages) and adds a new .github/renovate.json that extends the shared github>stranske/Workflows//renovate-presets/fleet preset.

Changes

Dependency Updater Migration

Layer / File(s)	Summary
Replace Dependabot with Renovate fleet preset .github/dependabot.yml, .github/renovate.json	Deletes the Dependabot configuration (68 lines covering weekly pip and GitHub Actions updates with ignored dev-tool packages) and adds a 4-line Renovate config extending the shared fleet preset.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately and concisely describes the main change: migrating from Dependabot to Renovate using the fleet preset configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/migrate-renovate

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[stranske-keepalive]

Workflow source needed

PR #721 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.