[RHIDP-11200] migrate renovate config from redhat-ai-dev/llama-stack

[michael-valdron]

What does this PR do?:

Migrates renovate config from redhat-ai-dev/llama-stack to preserve renovate patching setup done. Changes will also include revisions to account for migration changes done to consume our Lightspeed configurations under dependency components.

Which issue(s) this PR fixes:

https://redhat.atlassian.net/browse/RHIDP-11200

PR acceptance criteria:

Testing and documentation do not need to be complete in order for this PR to be approved. We just need to ensure tracking issues are opened and linked to this PR, if they are not in the PR scope due to various constraints.

• Tested and Verified

• Documentation (READMEs, Product Docs, Blogs, Education Modules, etc.)

How to test changes / Special notes to the reviewer:

[qodo-code-review]

Qodo is busy working

Check back in a few minutes. Qodo's code review agents are on it.

[qodo-code-review]

PR Summary by Qodo

Migrate Renovate config and pin GitHub Action SHAs

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Add repo-level Renovate configuration with schedules, branch rules, and grouping.
• Introduce custom regex manager for container image tags in images*.yml.
• Pin GitHub Actions used in validation workflow to immutable commit SHAs.

Diagram

graph TD
  R[Renovate Bot] --> C["renovate.json"] --> M["Managers & rules"] --> B["main + release-* branches"]
  M --> D[(Docker registry)]
  GH["GitHub Actions CI"] --> W[".github/workflows/validation.yml"] --> A["Pinned action SHAs"]
  subgraph Legend
    direction LR
    _svc([Service/Automation]) ~~~ _file["Config file"] ~~~ _db[(Registry/Store)]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Central shared Renovate preset

• ➕ Reduces duplication across repositories
• ➕ Easier to roll out policy changes consistently
• ➕ Keeps repo-level config focused on exceptions
• ➖ Requires maintaining a separate preset repo/package
• ➖ Adds indirection for contributors debugging Renovate behavior

2. Use Renovate-provided presets more heavily (less custom rules)

• ➕ Lower long-term maintenance
• ➕ Less risk of regex/packageRule edge cases
• ➖ May not support the image tag/version extraction nuances needed here
• ➖ Less control over release-branch patch-only behavior

Recommendation: The PR’s approach (repo-local renovate.json with explicit managers + targeted packageRules) is appropriate for preserving prior behavior and supporting release-branch constraints. If multiple repos will share the same policy long-term, consider factoring the common rules into a central preset and keeping only repo-specific overrides here.

Files changed (2) +88 / -4

Other (2) +88 / -4

validation.ymlPin checkout/setup-node/setup-python GitHub Actions to SHAs +4/-4

Pin checkout/setup-node/setup-python GitHub Actions to SHAs

• Replaces version tags (v4/v5) with pinned commit digests for actions/checkout, actions/setup-node, and actions/setup-python. This strengthens CI supply-chain security and aligns with Renovate digest pinning practices.

.github/workflows/validation.yml

renovate.jsonAdd Renovate config with schedules, release-branch rules, and image regex manager +84/-0

Add Renovate config with schedules, release-branch rules, and image regex manager

• Introduces a Renovate configuration enabling github-actions, npm, and a custom.regex manager for image tags in images*.yml. Adds schedule windows, main/release branch targeting, disables majors broadly, and constrains updates on release branches (including special patch-only handling for the lightspeed-stack image and loose version extraction for rag-content).

renovate.json

[Jdubrick]

lgtm