Enable Renovate for upgrading dependencies

Author: alexandru

.github/prompts/renovate-pr.md

@@ -0,0 +1,17 @@
+Review and fix this Renovate dependency update PR.
+
+Hard requirements:
+
+- Read and follow `AGENTS.md` and any project-specific `AGENTS.md` files.
+- Treat this PR as a dependency maintenance PR only. Do not make unrelated
+  refactors or feature changes.
+- Preserve public API and binary compatibility.
+- Inspect the dependency/build-tool updates already made by Renovate.
+- Run `make check-all`.
+- If the build, formatting, compilation, or tests fail, fix the failures on
+  this PR branch.
+- If no code changes are needed, leave the branch unchanged.
+- Do not merge or close the PR.
+
+When finished, summarize what you checked, what you fixed, and whether
+`make check-all` passes.

.github/renovate-config.js

@@ -0,0 +1,46 @@
+module.exports = {
+  platform: "github",
+  repositories: ["funfix/tasks"],
+  gitAuthor: "Renovate Bot <renovate@funfix.org>",
+  branchPrefix: "renovate/",
+  onboarding: false,
+  requireConfig: "optional",
+  recreateWhen: "always",
+  prHourlyLimit: 0,
+
+  extends: [":dependencyDashboard"],
+
+  enabledManagers: ["github-actions", "gradle", "gradle-wrapper", "sbt"],
+
+  ignorePaths: ["**/.gradle/**"],
+
+  packageRules: [
+    {
+      description: "Group all dependency updates into a single PR",
+      matchManagers: ["github-actions", "gradle", "gradle-wrapper", "sbt"],
+      groupName: "dependencies",
+      groupSlug: "all-dependencies",
+      group: {
+        commitMessageTopic: "dependencies",
+        commitMessageExtra: "",
+      },
+    },
+    {
+      description: "Only use stable dotted numeric JVM dependency versions",
+      matchManagers: ["gradle", "gradle-wrapper", "sbt"],
+      allowedVersions: "/^\\d+(?:\\.\\d+)+$/",
+    },
+    {
+      description: "Keep Scala on the 3.3.x line",
+      matchManagers: ["sbt"],
+      matchPackageNames: ["org.scala-lang:scala3-library_3"],
+      allowedVersions: "/^3\\.3\\.\\d+$/",
+    },
+    {
+      description: "Wait one week before proposing dependency updates",
+      matchManagers: ["github-actions", "gradle", "gradle-wrapper", "sbt"],
+      minimumReleaseAge: "7 days",
+      minimumReleaseAgeBehaviour: "timestamp-optional",
+    },
+  ],
+};

.github/workflows/opencode-renovate.yml

@@ -0,0 +1,60 @@
+name: opencode-renovate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: opencode-renovate-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  opencode:
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      startsWith(github.event.pull_request.head.ref, 'renovate/') &&
+      github.actor != 'github-actions[bot]' &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Checkout Renovate PR branch
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
+
+      - uses: actions/setup-java@v5
+        with:
+          java-version: "17"
+          distribution: temurin
+      - uses: sbt/setup-sbt@v1
+
+      - name: Configure git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global credential.helper '!f() { echo username=x-access-token; echo password=$GITHUB_TOKEN; }; f'
+
+      - name: Load prompt file
+        id: load-prompt
+        run: |
+          echo "content<<EOF" >> $GITHUB_OUTPUT
+          cat .github/prompts/renovate-pr.md >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Run opencode
+        uses: anomalyco/opencode/github@latest
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          model: opencode-go/deepseek-v4-pro
+          use_github_token: true
+          prompt: ${{ steps.load-prompt.outputs.content }}

.github/workflows/opencode-upgrades.yml

@@ -0,0 +1,22 @@
+name: Renovate
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Runs every Monday at 09:00 UTC
+    - cron: "0 9 * * 1"
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Renovate
+        uses: renovatebot/github-action@v46.1.14
+        with:
+          configurationFile: .github/renovate-config.js
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        # env:
+        #   LOG_LEVEL: debug

.github/workflows/renovate.yaml

@@ -14,26 +14,10 @@ Use the **jspecify-nullness** skill when working with JSpecify annotations, null
 
 ## Acceptance Criteria
 
-For all work to be considered complete:
-```sh
-./gradlew check
-```
-
-## HOW-TOs
+Work is not done until `make check-all` passes.
 
-### Update project's dependencies
-
-```bash
-make dependency-updates-ci
+```sh
+make check-all
 ```
 
-This will generate these reports:
-- For the Gradle project(s):
-  - `./build/dependencyUpdates/report.html`
-  - `./tasks-jvm/build/dependencyUpdates/report.html`
-  - `./tasks-kotlin-coroutines/build/dependencyUpdates/report.html`
 
-RULES: 
-- Never upgrade major versions (semver), instead ask the user or warn them!!!
-- Never upgrade to SNAPSHOT, RC, or milestone versions.
-- Fix breakage, but apply good judgement.

AGENTS.md

@@ -1,8 +1,11 @@
-.PHONY: build
+.PHONY: build check-all
 
 build:
 	./gradlew build
 
+check-all:
+	./gradlew check
+
 dependency-updates:
 	./gradlew dependencyUpdates \
 		-Drevision=release \