ci: self-hosted renovate (#7690)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: matthewelwell

.github/workflows/renovate.yml

@@ -0,0 +1,37 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  id-token: write # For CodeArtifact OIDC
+
+jobs:
+  renovate:
+    runs-on: depot-ubuntu-latest-16
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Authenticate with CodeArtifact
+        id: codeartifact
+        uses: ./.github/actions/codeartifact-login
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
+          private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }}
+
+      - name: Run Renovate
+        uses: renovatebot/github-action@v46.1.14
+        env:
+          RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_GIT_AUTHOR: ${{ vars.RENOVATE_GIT_AUTHOR }}
+          RENOVATE_HOST_RULES: >-
+            [{"matchHost":"flagsmith-production-084060095745.d.codeartifact.eu-west-2.amazonaws.com","username":"aws","password":"${{ steps.codeartifact.outputs.token }}"}]

renovate.json

@@ -4,6 +4,8 @@
     "security:only-security-updates",
     ":semanticCommitTypeAll(deps)"
   ],
+  "recreateClosed": true,
+  "rebaseWhen": "always",
   "packageRules": [
     {
       "matchManagers": ["uv"],