From 2106677c86a77e037f13184f4e57837f79ae36f1 Mon Sep 17 00:00:00 2001
From: Niels Pardon <par@zurich.ibm.com>
Date: Thu, 30 Jul 2026 20:43:43 +0200
Subject: [PATCH] ci: switch from dependabot to renovate

---
 .github/dependabot.yml         | 31 -------------------------------
 .github/workflows/pr_title.yml |  8 ++++++--
 renovate.json                  | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 33 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 renovate.json

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 5dd1749f..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
-
-  - package-ecosystem: "uv"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
-    groups:
-      substrait:
-        patterns:
-          - "substrait-protobuf"
-          - "substrait-antlr"
-          - "substrait-extensions"
-
-  - package-ecosystem: "docker"
-    directory: "/.devcontainer"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
diff --git a/.github/workflows/pr_title.yml b/.github/workflows/pr_title.yml
index afc8f363..2590a9a8 100644
--- a/.github/workflows/pr_title.yml
+++ b/.github/workflows/pr_title.yml
@@ -35,10 +35,14 @@ jobs:
       - run: npm install @commitlint/config-conventional
       - run: >
           echo 'module.exports = {
-            // Workaround for https://github.com/dependabot/dependabot-core/issues/5923
+            // Bot PR descriptions are not conventional-commit bodies, so do not lint them.
             "ignores": [
+              // Dependabot, see https://github.com/dependabot/dependabot-core/issues/5923.
+              // Kept while dependabot PRs opened before the switch to renovate are still open.
               (message) => /^Bumps \[.+]\(.+\) from .+ to .+\.$/m.test(message),
-              (message) => /^Updates the requirements on .+ to permit the latest version\.$/m.test(message)
+              (message) => /^Updates the requirements on .+ to permit the latest version\.$/m.test(message),
+              // Renovate
+              (message) => /^This PR contains the following updates:$/m.test(message)
             ],
             "rules": {
               "body-max-line-length": [0, "always", Infinity],
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..0a56338b
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,32 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    ":maintainLockFilesWeekly"
+  ],
+  "semanticCommits": "enabled",
+  "semanticCommitType": "chore",
+  "semanticCommitScope": "deps",
+  "packageRules": [
+    {
+      "description": "Port of the dependabot substrait group. check_substrait_package_versions.sh requires all three packages to carry the same version, so they have to move together",
+      "matchPackageNames": [
+        "substrait-protobuf",
+        "substrait-antlr",
+        "substrait-extensions"
+      ],
+      "groupName": "substrait packages"
+    },
+    {
+      "description": "Match the deps-dev scope dependabot used for development dependencies",
+      "matchDepTypes": ["dependency-groups", "project.optional-dependencies"],
+      "semanticCommitScope": "deps-dev"
+    },
+    {
+      "description": "Changing the supported Python version is a project decision, not a routine bump",
+      "matchPackageNames": ["python"],
+      "enabled": false
+    }
+  ]
+}