ci: update renovate config and workflow

.github/renovate.json5

@@ -1,20 +1,22 @@
 {
   // Configuration file for RenovateBot: https://docs.renovatebot.com/configuration-options
-  extends: ["config:base"],
+  extends: ["config:recommended", ":semanticCommitTypeAll(build)"],
   labels: ["dependencies"],  // For convenient searching in GitHub
+  baseBranches: ["$default", "/^hotfix\\/.*/"],
   pip_requirements: {
     fileMatch: ["^tox.ini$", "(^|/)requirements([\\w-]*)\\.txt$", "^.pre-commit-config.yaml$"]
   },
    packageRules: [
     {
       // Internal package minor patch updates get top priority, with auto-merging
-      groupName: "internal package patch releases",
+      groupName: "internal package minor releases",
       matchPackagePatterns: ["^craft-.*"],
       matchUpdateTypes: ["minor", "patch", "pin", "digest"],
       prPriority: 10,
       automerge: true,
       minimumReleaseAge: "0 seconds",
       schedule: ["at any time"],
+      matchBaseBranches: ["$default"],  // Only do minor releases on main
     },
     {
       // Same as above, but for hotfix branches, only for patch, and without auto-merging.
@@ -24,7 +26,7 @@
       prPriority: 10,
       minimumReleaseAge: "0 seconds",
       schedule: ["at any time"],
-      matchBaseBranches: ["/^hotfix/.*/"],  // All hotfix branches
+      matchBaseBranches: ["/^hotfix\\/.*/"],  // All hotfix branches
     },
     {
       // Automerge patches, pin changes and digest changes.
@@ -39,8 +41,9 @@
       // Update all internal packages in one higher-priority PR
       groupName: "internal packages",
       matchDepPatterns: ["craft-.*", "snap-.*"],
-      matchLanguages: ["python"],
-      prPriority: 2
+      matchCategories: ["python"],
+      prPriority: 2,
+      matchBaseBranches: ["$default"],  // Not for hotfix branches
     },
     {
       // GitHub Actions are higher priority to update than most dependencies since they don't tend to break things.
@@ -64,6 +67,28 @@
         "lint/.*",
         "types/.*"
       ],
+      matchPackagePatterns: [
+        // Brought from charmcraft. May not be complete.
+        // This helps group dependencies in requirements-dev.txt files.
+        "^(.*/)?autoflake$",
+        "^(.*/)?black$",
+        "^(.*/)?codespell$",
+        "^(.*/)?coverage$",
+        "^(.*/)?flake8$",
+        "^(.*/)?hypothesis$",
+        "^(.*/)?mypy$",
+        "^(.*/)?pycodestyle$",
+        "^(.*/)?docstyle$",
+        "^(.*/)?pyfakefs$",
+        "^(.*/)?pyflakes$",
+        "^(.*/)?pylint$",
+        "^(.*/)?pytest",
+        "^(.*/)?responses$",
+        "^(.*/)?ruff$",
+        "^(.*/)?twine$",
+        "^(.*/)?tox$",
+        "^(.*/)?types-",
+      ],
       matchUpdateTypes: ["minor", "patch", "pin", "digest"],
       prPriority: -1,
       automerge: true
@@ -75,31 +100,36 @@
       matchPackageNames: ["Sphinx", "furo"],
       matchPackagePatterns: ["[Ss]phinx.*$"],
       matchDepPatterns: ["docs/.*"],
+      matchBaseBranches: ["$default"],  // Not for hotfix branches
     },
     {
       // Other major dependencies get deprioritised below minor dev dependencies.
       matchUpdateTypes: ["major"],
-      prPriority: -2
+      prPriority: -2,
+      matchBaseBranches: ["$default"],  // Not for hotfix branches
     },
     {
       // Major dev dependencies are stone last, but grouped.
       groupName: "development dependencies (major versions)",
       groupSlug: "dev-dependencies",
       matchDepTypes: ["devDependencies"],
       matchUpdateTypes: ["major"],
-      prPriority: -3
+      prPriority: -3,
+      matchBaseBranches: ["$default"],  // Not for hotfix branches
     },
     {
       // Pyright makes regular breaking changes in patch releases, so we separate these
       // and do them independently.
       matchPackageNames: ["pyright", "types/pyright"],
-      prPriority: -4
+      prPriority: -4,
+      matchBaseBranches: ["$default"],  // Not for hotfix branches
     }
   ],
-  regexManagers: [
+  customManagers: [
     {
       // tox.ini can get updates too if we specify for each package.
       fileMatch: ["tox.ini"],
+      customType: "regex",
       depTypeTemplate: "devDependencies",
       matchStrings: [
         "# renovate: datasource=(?<datasource>\\S+)\n\\s+(?<depName>.*?)(\\[[\\w]*\\])*[=><]=?(?<currentValue>.*?)\n"
@@ -108,6 +138,7 @@
     {
       // .pre-commit-config.yaml version updates
       fileMatch: [".pre-commit-config.yaml"],
+      customType: "regex",
       datasourceTemplate: "pypi",
       depTypeTemplate: "lint",
       matchStrings: [
@@ -122,7 +153,7 @@
   prCreation: "not-pending", // Wait until status checks have completed before raising the PR
   prNotPendingHours: 4, // ...unless the status checks have been running for 4+ hours.
   prHourlyLimit: 1, // No more than 1 PR per hour.
-  stabilityDays: 2, // Wait 2 days from release before updating.
+  minimumReleaseAge: "2 days",
   automergeStrategy: "squash", // Squash & rebase when auto-merging.
   semanticCommitType: "build"  // use `build` as commit header type (i.e. `build(deps): <description>`)
 }

.github/workflows/check-renovate.yaml

@@ -20,6 +20,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Install node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
       - name: Install renovate
         run: npm install --global renovate
       - name: Enable ssh access