Add Renovate for automated tool updates

.github/workflows/renovate.yml

@@ -0,0 +1,41 @@
+name: Renovate
+
+on:
+  schedule:
+  - cron: '0 6 * * *' # daily, 06:00 UTC
+  workflow_dispatch:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+
+  renovate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+    - uses: actions/checkout@v5
+    - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 #v46.1.14
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        # Use the checked-out config (the branch being run on) as Renovate's
+        # config, mounted into the container — no config needed on the default
+        # branch.
+        configurationFile: renovate.json5
+      env:
+        RENOVATE_REPOSITORIES: ${{ github.repository }}
+        # Operate on the branch that triggered the run (the PR's source branch
+        # on pull_request, otherwise the branch the workflow ran on).
+        RENOVATE_BASE_BRANCH_PATTERNS: '["${{ github.head_ref || github.ref_name }}"]'
+        # Don't require a config on the default branch, and never onboard.
+        RENOVATE_REQUIRE_CONFIG: optional
+        RENOVATE_ONBOARDING: 'false'
+        # Dry run on pull requests.
+        RENOVATE_DRY_RUN: ${{ github.event_name == 'pull_request' && 'full' || '' }}
+        LOG_LEVEL: ${{ github.event_name == 'pull_request' && 'debug' || 'info' }}

renovate.json5

@@ -0,0 +1,29 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: ['config:recommended'],
+
+  // Hold every update until the release is at least 7 days old, and always
+  // target the newest version that passes that age check rather than the
+  // absolute latest (so we never jump onto a brand-new release).
+  minimumReleaseAge: '7 days',
+  internalChecksFilter: 'strict',
+
+  customManagers: [
+    {
+      // cargo tools installed via `cargo install` in the build matrix.
+      customType: 'regex',
+      managerFilePatterns: ['/^\\.github/workflows/build\\.yml$/'],
+      matchStrings: ["name: (?<depName>[\\w-]+)\\s+version: '(?<currentValue>[^']+)'"],
+      datasourceTemplate: 'crate',
+    },
+    {
+      // go tools installed via `go install` in the build matrix. The version is
+      // stored without a leading `v`, so strip it from the upstream tag.
+      customType: 'regex',
+      managerFilePatterns: ['/^\\.github/workflows/build\\.yml$/'],
+      matchStrings: ["import-path: (?<depName>github\\.com/[^/\\s]+/[^/\\s]+)[^\\n]*\\s+version: '(?<currentValue>[^']+)'"],
+      datasourceTemplate: 'go',
+      extractVersionTemplate: '^v?(?<version>.+)$',
+    },
+  ],
+}