feat(renovate): create shared Renovate configuration files

Create shared Renovate configuration files, to be used by all repositories
in the bootc-dev org.

Some of the configuration has been inspired by the RedHat
[github.com/platform-engineering-org/.github](https://github.com/platform-engineering-org/.github)
configuration repository.

Signed-off-by: Robert Sturla <[email protected]>

Author: p5

renovate-config.js

@@ -1,21 +1,29 @@
 module.exports = {
+  // Find all repositories the GitHub App token has permissions to
   autodiscover: true,
-  branchPrefix: 'test-renovate/',
+
+  // Don't create the onboarding PRs
+  //
+  // All repositories in the organisation will inherit the shared configuration
+  // (./renovate-shared-config.json) by default unless they opt-out.
+  onboarding: false,
+
+  // Centralise all Renovate configuration into this repository
+  //
+  // This allows for easier management of Renovate settings across multiple
+  // repositories.  Each individual repository can still contain their own
+  // configuration.
+  inheritConfig: true,
+  inheritConfigRepoName: '{{parentOrg}}/infra',
+  inheritConfigFileName: "renovate-shared-config.json",
+  inheritConfigStrict: true,
+
+  // Prefix all branches created by Renovate with "bootc-renovate/"
+  branchPrefix: 'bootc-renovate/',
+
+  // Configure Renovate to use GitHub-specific API calls
   platform: 'github',
+
+  // Enable dependency updates on forked repositories in the organisation
   forkProcessing: 'enabled',
-  packageRules: [
-    {
-      description: 'lockFileMaintenance',
-      matchUpdateTypes: [
-        'pin',
-        'digest',
-        'patch',
-        'minor',
-        'major',
-        'lockFileMaintenance',
-      ],
-      dependencyDashboardApproval: false,
-      minimumReleaseAge: '0 days',
-    },
-  ],
 };

renovate-shared-config.json

@@ -0,0 +1,64 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    // Base configuration
+    "config:best-practices",
+
+    // Add "Signed-off-by" footer to commit messages
+    ":gitSignOff",
+
+    // Catch-all for grouping dependencies not caught by other groups
+    "group:all"
+  ],
+
+  // Rebase when there are merge conflicts
+  //
+  // The "conflicted" option is typically the ideal choice for most situations
+  // where you don't want to burn CI credits, while still keeping your branch
+  // in a mergeable state at all times.
+  "rebaseWhen": "conflicted",
+
+  "packageRules": [
+    // Group GitHub Actions dependencies
+    {
+      "description": "GitHub Actions dependencies",
+      "matchManagers": ["github-actions"],
+      "groupName": "GitHub Actions",
+      "enabled": true
+    },
+
+    // Group Rust dependencies
+    {
+      "description": "Rust dependencies",
+      "matchManagers": ["cargo"],
+      "groupName": "Rust",
+      "enabled": true
+    },
+
+    // Group Docker dependencies
+    {
+      "description": "Docker dependencies",
+      "matchManagers": ["dockerfile"],
+      "groupName": "Docker",
+      "enabled": true
+    },
+
+    // Disable Containerfile digest pinning
+    {
+      "description": "Containerfile digest pinning",
+      "matchManagers": ["dockerfile"],
+      "pinDigests": false
+    },
+
+    // Disable Fedora OCI updates
+    //
+    // This is due to there not being an easy way to tell Renovate which
+    // Fedora version is "stable" and which has not been released yet.
+    {
+      "description": "Disable Fedora OCI updates",
+      "matchManagers": ["dockerfile"],
+      "matchDepNames": ["quay.io/fedora/fedora"],
+      "enabled": false
+    }
+  ]
+}