ci: add/update workflow for running renovate

Author: wetransformer

.github/workflows/tf-renovate.yml

@@ -46,6 +46,9 @@ env:
   # https://docs.renovatebot.com/self-hosted-configuration/#dryrun
   # Run renovate in dry-run mode if executed in branches other than master - prevents versions in PRs/branches from being updated
   RENOVATE_DRY_RUN: "${{ inputs.dryRun || ( github.head_ref || github.ref_name ) != 'master' || false }}"
+  # Allow calling Gradle wrapper (required since Renovate 43)
+  # https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions
+  RENOVATE_ALLOWED_UNSAFE_EXECUTIONS: '["gradleWrapper"]'
   # Renovate Automerge
   # RENOVATE_AUTOMERGE_TYPE: "branch"
   # RENOVATE_AUTOMERGE: "true"
@@ -69,6 +72,6 @@ jobs:
           private-key: "${{ secrets.WE_RENOVATE_GITHUB_PRIVATE_KEY }}"
 
       - name: 💡 Self-hosted Renovate
-        uses: renovatebot/github-action@eaf12548c13069dcc28bb75c4ee4610cdbe400c5 # v44.2.6
+        uses: renovatebot/github-action@3c68caaa9db5ff24332596591dc7c4fed8de16ce # v46.0.1
         with:
           token: "${{ steps.app-token.outputs.token }}"