Add renovate for repo updates

Author: alexandru

.github/prompts/renovate-pr.md

@@ -0,0 +1,17 @@
+Review and fix this Renovate dependency update PR.
+
+Hard requirements:
+
+- Read and follow `AGENTS.md` and any project-specific `AGENTS.md` files.
+- Treat this PR as a dependency maintenance PR only. Do not make unrelated
+  refactors or feature changes.
+- Preserve public API and binary compatibility.
+- Inspect the dependency/build-tool updates already made by Renovate.
+- Run `make check-all`.
+- If the build, formatting, compilation, or tests fail, fix the failures on
+  this PR branch.
+- If no code changes are needed, leave the branch unchanged.
+- Do not merge or close the PR.
+
+When finished, summarize what you checked, what you fixed, and whether
+`make check-all` passes.

.github/renovate-config.js

@@ -0,0 +1,39 @@
+module.exports = {
+  platform: "github",
+  repositories: ["funfix/database"],
+  gitAuthor: "Renovate Bot <renovate@funfix.org>",
+  branchPrefix: "renovate/",
+  onboarding: false,
+  requireConfig: "optional",
+
+  extends: [":dependencyDashboard"],
+
+  enabledManagers: ["github-actions", "gradle", "gradle-wrapper", "sbt"],
+
+  ignorePaths: ["**/.gradle/**"],
+
+  packageRules: [
+    {
+      description: "Group all dependency updates into a single PR",
+      matchManagers: ["github-actions", "gradle", "gradle-wrapper", "sbt"],
+      groupName: "dependencies",
+      groupSlug: "all-dependencies",
+      recreateWhen: "always",
+      group: {
+        commitMessageTopic: "dependencies",
+        commitMessageExtra: "",
+      },
+    },
+    {
+      description: "Only use stable dotted numeric JVM dependency versions",
+      matchManagers: ["gradle", "gradle-wrapper", "sbt"],
+      allowedVersions: "/^\\d+(?:\\.\\d+)+$/",
+    },
+    {
+      description: "Wait one week before proposing dependency updates",
+      matchManagers: ["github-actions", "gradle", "gradle-wrapper", "sbt"],
+      minimumReleaseAge: "1 days",
+      minimumReleaseAgeBehaviour: "timestamp-optional",
+    },
+  ],
+};

.github/workflows/opencode-renovate.yml

@@ -0,0 +1,53 @@
+name: opencode-renovate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: opencode-renovate-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  opencode:
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      startsWith(github.event.pull_request.head.ref, 'renovate/') &&
+      github.actor != 'github-actions[bot]' &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Checkout Renovate PR branch
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
+
+      - uses: actions/setup-java@v5
+        with:
+          java-version: "21"
+          distribution: temurin
+      - uses: sbt/setup-sbt@v1
+
+      - name: Load prompt file
+        id: load-prompt
+        run: |
+          echo "content<<EOF" >> $GITHUB_OUTPUT
+          cat .github/prompts/renovate-pr.md >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Run opencode
+        uses: anomalyco/opencode/github@latest
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          model: opencode-go/deepseek-v4-pro
+          use_github_token: true
+          prompt: ${{ steps.load-prompt.outputs.content }}

.github/workflows/renovate.yaml

@@ -0,0 +1,19 @@
+name: Renovate
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 4 * * 1'
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Renovate
+        uses: renovatebot/github-action@v46.1.14
+        with:
+          configurationFile: .github/renovate-config.js
+          token: ${{ secrets.RENOVATE_TOKEN }}