ci: switch from dependabot to renovate

.github/workflows/pr_title.yml

@@ -35,10 +35,14 @@ jobs:
       - run: npm install @commitlint/config-conventional
       - run: >
           echo 'module.exports = {
-            // Workaround for https://github.com/dependabot/dependabot-core/issues/5923
+            // Bot PR descriptions are not conventional-commit bodies, so do not lint them.
             "ignores": [
+              // Dependabot, see https://github.com/dependabot/dependabot-core/issues/5923.
+              // Kept while dependabot PRs opened before the switch to renovate are still open.
               (message) => /^Bumps \[.+]\(.+\) from .+ to .+\.$/m.test(message),
-              (message) => /^Updates the requirements on .+ to permit the latest version\.$/m.test(message)
+              (message) => /^Updates the requirements on .+ to permit the latest version\.$/m.test(message),
+              // Renovate
+              (message) => /^This PR contains the following updates:$/m.test(message)
             ],
             "rules": {
               "body-max-line-length": [0, "always", Infinity],

.github/workflows/stale.yml

@@ -15,6 +15,9 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-issue-stale: -1 # don't operate on issues
+          # Renovate PRs are immortal: it recreates closed grouped and lock
+          # file maintenance PRs, so staling them only produces churn.
+          exempt-pr-labels: dependencies
           stale-pr-message: |
             This PR has been automatically marked as stale because it has not had
             recent activity. It will be closed in 7 days if no further activity occurs.

renovate.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    ":maintainLockFilesWeekly"
+  ],
+  "semanticCommits": "enabled",
+  "semanticCommitType": "chore",
+  "semanticCommitScope": "deps",
+  "fetchChangeLogs": "off",
+  "labels": ["dependencies"],
+  "minimumReleaseAge": "14 days",
+  "pre-commit": {
+    "enabled": true
+  },
+  "packageRules": [
+    {
+      "description": "Port of the dependabot substrait group. check_substrait_package_versions.sh requires all three packages to carry the same version, so they have to move together. Exempt from the cooldown: we publish these ourselves, so there is no third-party release to let the ecosystem vet",
+      "matchPackageNames": [
+        "substrait-protobuf",
+        "substrait-antlr",
+        "substrait-extensions"
+      ],
+      "groupName": "substrait packages",
+      "minimumReleaseAge": null
+    },
+    {
+      "description": "ruff is declared in both [tool.pixi.dependencies] and .pre-commit-config.yaml, so keep the hook revision in step with the pixi range rather than letting them drift apart in separate PRs. Both are development tooling, so they take the deps-dev scope. Lock file maintenance is excluded: the pep621 manager already refreshes pixi.lock in the regular lock file maintenance PR, and a second grouped branch rewriting the same file would conflict with it",
+      "matchManagers": ["pixi", "pre-commit"],
+      "matchUpdateTypes": ["!lockFileMaintenance"],
+      "groupName": "pixi and pre-commit tooling",
+      "semanticCommitScope": "deps-dev"
+    },
+    {
+      "description": "Match the deps-dev scope dependabot used for development dependencies",
+      "matchDepTypes": ["dependency-groups", "project.optional-dependencies"],
+      "semanticCommitScope": "deps-dev"
+    },
+    {
+      "description": "Changing the supported Python version is a project decision, not a routine bump",
+      "matchPackageNames": ["python"],
+      "enabled": false
+    }
+  ]
+}