From 9b16d94e8a545f4eb6d9e57c9410ec978685b895 Mon Sep 17 00:00:00 2001
From: "privilegedescalation-engineer[bot]"
 <269729446+privilegedescalation-engineer[bot]@users.noreply.github.com>
Date: Wed, 13 May 2026 17:31:00 +0000
Subject: [PATCH] Add Renovate GitHub Actions workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds .github/workflows/renovate.yaml — scheduled Renovate run every Saturday at 02:00 UTC using create-github-app-token with RELEASE_APP_ID/RELEASE_APP_PRIVATE_KEY. Runs renovatebot/github-action@v41.0.0 with autodiscover and renovate-config.json. Includes workflow_dispatch for manual triggering.

Pipeline B infrastructure change reviewed by CTO and QA (Regression Regina).
---
 .github/workflows/renovate.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .github/workflows/renovate.yaml

diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000..51001ec
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,30 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '0 2 * * 6'  # Saturday 2:00 UTC — aligns with "every weekend" in renovate-config.json
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: runners-privilegedescalation
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: privilegedescalation
+
+      - name: Run Renovate
+        uses: renovatebot/github-action@v41.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          configurationFile: renovate-config.json
+        env:
+          LOG_LEVEL: debug
+          RENOVATE_AUTODISCOVER: "true"