ci: add/update workflow for running renovate

.github/workflows/tf-renovate.yml

@@ -0,0 +1,71 @@
+---
+#
+# PLEASE NOTE: Managed workflow - do not change manually
+#
+name: Renovate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        type: boolean
+        description: "Dry-Run"
+      logLevel:
+        type: choice
+        description: "Log-Level"
+        default: debug
+        options:
+          - info
+          - debug
+          - trace
+  push:
+    branches:
+      - master
+      # branches that can be used for dry-runs
+      - ci/renovate
+      - ci/renovate/*
+      # exclude branches created by renovate (by convention, requires respective config for renovate)
+      - "!renovate/*"
+  schedule:
+    - cron: "0 0,2,4 * * 0"
+
+env:
+  # https://docs.renovatebot.com/troubleshooting/#log-debug-levels
+  LOG_LEVEL: "${{ inputs.logLevel || 'debug' }}"
+  # https://docs.renovatebot.com/self-hosted-configuration/#repositories
+  RENOVATE_REPOSITORIES: ${{ github.repository }}
+  # https://docs.renovatebot.com/self-hosted-configuration/#username
+  # If using a GitHub App as we do, the username needs to be the app name + [bot] (otherwise it fails to identify existing PRs)
+  # see https://github.com/renovatebot/renovate/discussions/13708#discussioncomment-2013249
+  RENOVATE_USERNAME: we-renovate[bot] # ${{ github.repository_owner }}
+  # https://docs.renovatebot.com/configuration-options/#platformcommit
+  RENOVATE_PLATFORM_COMMIT: "true"
+  # https://docs.renovatebot.com/self-hosted-configuration/#dryrun
+  # Run renovate in dry-run mode if executed in branches other than master - prevents versions in PRs/branches from being updated
+  RENOVATE_DRY_RUN: "${{ inputs.dryRun || ( github.head_ref || github.ref_name ) != 'master' || false }}"
+  # Renovate Automerge
+  # RENOVATE_AUTOMERGE_TYPE: "branch"
+  # RENOVATE_AUTOMERGE: "true"
+
+permissions: read-all
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
+        id: app-token
+        with:
+          # see https://github.com/renovatebot/renovate/blob/47c8501c412c2f53f61ca292a5039f5939c32c5d/lib/modules/platform/github/readme.md?plain=1#L28
+          app-id: ${{ secrets.WE_RENOVATE_GITHUB_APP_ID }}
+          private-key: "${{ secrets.WE_RENOVATE_GITHUB_PRIVATE_KEY }}"
+
+      - name: 💡 Self-hosted Renovate
+        uses: renovatebot/github-action@10b0dbf049fea8f04c079c8802145f3eac72d9e7 # v40.1.8
+        with:
+          token: "${{ steps.app-token.outputs.token }}"