From bdcb59161697a1bfd971d8d9c6747fb74c17de99 Mon Sep 17 00:00:00 2001
From: glokos <assem@hasna.io>
Date: Fri, 3 Jul 2026 16:02:10 +0200
Subject: [PATCH] =?UTF-8?q?chore:=20migrate=20github-actions=20updates=20f?=
 =?UTF-8?q?rom=20dependabot=20to=20renovate=20=F0=9F=A4=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/dependabot.yml |  7 -------
 .github/renovate.json5 | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 7 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 .github/renovate.json5

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 23c4cb3..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..3013ea0
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,32 @@
+// This file follows JSON5 syntax, to make it
+// easier to maintain.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  // Disable every built-in manager (npm, dockerfile, ...) except github-actions.
+  enabledManagers: ["github-actions"],
+  // PR titles use Conventional Commits: `deps(<action>): ...`
+  semanticCommits: "enabled",
+  semanticCommitType: "deps",
+  packageRules: [
+    // GitHub Actions updates: run weekly, skip releases newer than 2 weeks
+    // to avoid picking up freshly published versions that may be unstable or
+    // compromised, and pin to full commit SHAs (with the version as a
+    // trailing comment) rather than mutable tags.
+    // When both major and minor releases exist, propose only the latest bump
+    // (typically major) instead of a separate minor PR.
+    {
+      matchManagers: ["github-actions"],
+      schedule: ["on monday"],
+      minimumReleaseAge: "14 days",
+      // Track upgrades by semver tag, but pin the resolved version to its full
+      // commit SHA (semver tag kept as a trailing comment). Use the coerced
+      // variant so short tags like `v3` / `v1.7` (which several actions only
+      // publish) still parse instead of silently stopping updates.
+      versioning: "semver-coerced",
+      pinDigests: true,
+      separateMajorMinor: false,
+      semanticCommitScope: "{{depName}}",
+      commitMessageTopic: "{{depName}}",
+    },
+  ],
+}