[ysinghc]

Description of Changes

Adds .github/renovate.json to onboard Renovate for automated dependency updates in the devfile/alizer repository.

• Pins GitHub Action versions to commit digests (helpers:pinGitHubActionDigests).
• Groups GitHub Actions updates into a single PR.
• Runs on the org's standard schedule (timezone America/Toronto).
• Enables vulnerability alerts and applies the renovatebot label.

Related Issue(s)

#1729

Acceptance Criteria

• Add renovate configuration to be picked up by organization renovate bot

Notes To Reviewer

Enable the Renovate GitHub app on the repo.

Summary by CodeRabbit

• Chores
  • Added automated dependency update management for GitHub Actions.
  • GitHub Actions updates are grouped and scheduled automatically.
  • Dependency updates are pinned, signed, and monitored for vulnerabilities.
  • Update activity is rate-limited and labeled for easier tracking.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 111db3f3-738b-4b25-8f97-6dd85e277574

📥 Commits

Reviewing files that changed from the base of the PR and between b731f0f and 3561e36.

📒 Files selected for processing: 1

• .github/renovate.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request adds Renovate configuration for GitHub Actions. It sets update scheduling and grouping, enables vulnerability alerts, and configures commit signing, digest pinning, PR limits, and a label.

Changes: Renovate configuration

Layer / File(s)	Summary
Configure GitHub Actions updates .github/renovate.json	The new configuration limits Renovate to GitHub Actions and sets scheduling, grouping, security alerts, PR limits, commit signing, digest pinning, and a label.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 3561e

The Renovate configuration is mergeable on the available evidence; the intended organization schedule was not supplied for comparison.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the addition of Renovate configuration for GitHub Actions updates, which is the main change in the pull request.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[michael-valdron]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: michael-valdron, ysinghc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [michael-valdron]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment