chore(renovate): converge shared preset to root renovate-config

Andrew Dunnrequested to merge
renovate/l0-public-sector into main

Summary

Converges the Public Sector Renovate configuration onto a single shared preset.

  • Adds renovate-config.json at the repository root as the converged shared preset, referenced going forward as gitlab>gitlab-com/public-sector/pipeline:renovate-config.
  • The preset folds estate-wide policy that previously lived in the pipeline self-config: config:best-practices base, weekly Monday schedule, semantic commits, 7 day minimum release age, strict internal checks, OSV vulnerability alerts, and the major-bump, go-toolchain, UBI, cosign and syft package rules. It keeps the cosign <3.0.0 cap (v3 OCI referrer format breaks buildah signing and the GitLab Container Registry) and the Fedora <=44 cap (avoid pre-release tags).
  • Carries the consumer-facing custom managers into the shared preset: the Containerfile ARG pin manager and the catalog component-pin manager.
  • Updates the repository self-config (renovate.json) to extend the shared preset and retain only repo-specific bits: the CI-input cosign pin manager and the gitlabci/dockerfile manager file patterns.
  • Replaces presets/renovate.json with a thin back-compat shim that extends the new root preset, so consumers still referencing the old path keep working during migration.

Review gate

This estate stays review-gated. platformAutomerge remains false and every package rule keeps automerge: false. The automerge change is deferred until the CI verification gate exists and the work-floor decision is made.

Validation

All three changed JSON files pass renovate-config-validator --strict (renovate 43).

Do not merge without human review.

Merge request reports