Replace dependabot.yml with renovate.json

.github/workflows/heroku.yaml

@@ -3,26 +3,22 @@ name: Heroku
 
 on:
   deployment_status:
-  issue_comment:
-    types: [created, edited]
 
 jobs:
   deployment-status:
     name: Check deployment status
     runs-on: ubuntu-latest
 
-    # Continue only if some definitive status has been reported. Also allow
-    # manual refresh of status checks by commenting '/refresh-heroku-status'.
-    if: ${{ github.event.deployment_status.state != 'pending'
-      || (contains(github.event.comment.body, '/refresh-heroku-status') && github.event.issue.pull_request) }}
+    # Continue only if some definitive status has been reported.
+    if: ${{ github.event.deployment_status.state != 'pending' }}
 
     steps:
-      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       # Forward deployment's status to the deployed commit.
-      - uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
+      - uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -38,27 +34,25 @@ jobs:
     name: Check site health
     runs-on: ubuntu-latest
 
-    # Run health check only if deployment succeeds. Also allow manual refresh
-    # of status checks by commenting '/refresh-heroku-status'.
-    if: ${{ github.event.deployment_status.state == 'success'
-      || (contains(github.event.comment.body, '/refresh-heroku-status') && github.event.issue.pull_request) }}
+    # Run health check only if deployment succeeds.
+    if: ${{ github.event.deployment_status.state == 'success' }}
 
     # Check that the deployed app returns successful HTTP response.
     steps:
-      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - id: health_check
-        uses: jtalk/url-health-check-action@b716ccb6645355dd9fcce8002ce460e5474f7f00 # v4
+        uses: jtalk/url-health-check-action@e7d5ebdc9027fbf494d2d034f3e8fc78f8b7a2b9 # v5
         with:
           url: ${{ github.event.deployment.payload.web_url }}
           follow-redirect: true
           max-attempts: 4
           retry-delay: 30s
         continue-on-error: true
       # Set appropriate status to the deployed commit.
-      - uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
+      - uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

renovate.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base"],
+  "timezone": "America/Los_Angeles",
+  "packageRules": [
+    {
+      "description": "Monthly updates for GitHub Actions, grouped together",
+      "matchManagers": ["github-actions"],
+      "groupName": "actions",
+      "schedule": ["after 5am on the first day of the month"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Weekly Docker dependency updates on Mondays",
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "schedule": ["after 5am on monday"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Ignore odd-numbered Node.js major versions in Docker (non-LTS). Even-numbered releases are also skipped for the first 6 months, but there is no way to configure that here yet.",
+      "matchManagers": ["dockerfile"],
+      "matchPackageNames": ["node"],
+      "allowedVersions": "/^([0-9]*[02468])\\.(\\d+)/"
+    },
+    {
+      "description": "Weekly Elixir/Mix dependency updates on Mondays",
+      "matchManagers": ["mix"],
+      "schedule": ["after 5am on monday"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Weekly npm dependency updates on Mondays",
+      "matchManagers": ["npm"],
+      "schedule": ["after 5am on monday"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Group miscellaneous npm dependencies (catch-all, excludes packages that get individual PRs)",
+      "matchManagers": ["npm"],
+      "excludePackageNames": ["typescript", "phoenix", "@types/node"],
+      "groupName": "misc"
+    },
+    {
+      "description": "Group Next.js and React framework dependencies",
+      "matchManagers": ["npm"],
+      "matchPackageNames": ["next", "react", "react-dom", "@types/react", "@types/react-dom"],
+      "groupName": "frameworks"
+    },
+    {
+      "description": "Group MUI, Emotion, and Fontsource styling dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^@mui/", "^@emotion/", "^@fontsource/"],
+      "groupName": "styles"
+    },
+    {
+      "description": "Group GraphQL and data fetching dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^graphql$", "^@graphql-codegen/", "^@tanstack/react-query"],
+      "groupName": "requests"
+    },
+    {
+      "description": "Group Leaflet and map dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^leaflet", "^react-leaflet$", "^@types/leaflet$"],
+      "groupName": "map"
+    },
+    {
+      "description": "Group Video.js player dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^video\\.js$", "^videojs", "^@types/video\\.js$"],
+      "groupName": "player"
+    },
+    {
+      "description": "Group ESLint, Prettier, and code style dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^eslint", "^@typescript-eslint/", "^prettier$", "^lint-staged$", "^husky$"],
+      "groupName": "code-style"
+    },
+    {
+      "description": "Ignore eslint-plugin-unused-imports versions 4.0 - 4.1",
+      "matchPackageNames": ["eslint-plugin-unused-imports"],
+      "allowedVersions": "< 4.0.0 || >= 4.2.0"
+    },
+    {
+      "description": "Ignore @typescript-eslint/eslint-plugin versions 8.0 - 8.9",
+      "matchPackageNames": ["@typescript-eslint/eslint-plugin"],
+      "allowedVersions": "< 8.0.0 || >= 8.10.0"
+    }
+  ]
+}