chore(deps): replace Dependabot version updates with Renovate

.github/workflows/renovate.yml

@@ -0,0 +1,53 @@
+name: Renovate
+
+# Deterministic dependency-update PRs (same pattern as Lou-Lou-CH/lou-lou and
+# sobatista-vulnerable-apis/base-project). Policy lives in the shared preset this
+# repo's renovate.json extends; repo-specific scope lives in renovate.json itself.
+#
+# Uses a PAT (RENOVATE_TOKEN), not GITHUB_TOKEN, so the PRs it opens trigger this
+# repo's own CI like any other PR (GITHUB_TOKEN-authored PRs do not trigger
+# workflows). Without the secret the job is a no-op notice, never a failure.
+#
+# Runs every 6 hours so security PRs (vulnerabilityAlerts, "at any time") are not
+# held back a week and green automerge-eligible PRs merge on the next pass; routine
+# PRs are still limited to the Monday-morning window by the preset's `schedule`.
+
+on:
+  schedule:
+    - cron: '17 */6 * * *'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+# One run at a time; a manual run waits for the scheduled one instead of racing it.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check for RENOVATE_TOKEN
+        id: check
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+        run: |
+          if [ -n "$RENOVATE_TOKEN" ]; then
+            echo "has_token=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::RENOVATE_TOKEN not set, skipping. Needs a fine-grained PAT on this repo with contents, pull-requests, issues, workflows and commit-statuses write, plus Dependabot alerts read."
+            echo "has_token=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: renovatebot/github-action@e09d604f8f803bb527bd8321ed5be06c460b8682 # v46.2.2
+        if: steps.check.outputs.has_token == 'true'
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_ONBOARDING: 'false'
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info

CHANGELOG.md

@@ -5,6 +5,9 @@ All notable changes to Agon are documented here. The format follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- Dependency updates move from Dependabot to self-hosted Renovate (`renovate.json`, weekly grouped PRs; GitHub Dependabot
+  security alerts stay on).
 
 ## [0.1.0] - 2026-10-15
 ### Added

renovate.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>MRegra/fedora-workstation-scripts//renovate/default"],
+  "description": [
+    "Scope mirrors the Dependabot config this replaces: Maven (root pom drives every module) and GitHub Actions."
+  ],
+  "enabledManagers": ["maven", "github-actions"]
+}