chore: Add renovate configuration

[thompson-tomo]

Fixes # (issue)

Changes

Adds in a renovate config to mirror setup in contrib. Only difference in setups is enablement of docker updates ie devContainers.

the goal will be to eventually automate cmake fetchContent updates etc.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.51%. Comparing base (a3f652f) to head (9e759e2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4568   +/-   ##
=======================================
  Coverage   86.51%   86.51%           
=======================================
  Files         525      525           
  Lines       20464    20464           
=======================================
  Hits        17702    17702           
  Misses       2762     2762           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lalitb]

Thanks for adding this. Are we planning to replace Dependabot with Renovate, or use Renovate only for dependencies Dependabot doesn't cover? It would be good to agree on that first, so we avoid duplicate update PRs and keep our existing seven-day cooldown.

[thompson-tomo]

The intention is to mirror what all languages do (except rust) which is use renovate where possible & dependabot for security updates.

Is The cooldown needed given it was only added a few weeks ago by zizmor & zizmor doesn't suggest adding it to renovate?

See prior discussion open-telemetry/opentelemetry-cpp-contrib#640

[lalitb]

The intention is to mirror what all languages do (except rust) which is use renovate where possible & dependabot for security updates.

Is The cooldown needed given it was only added a few weeks ago by zizmor & zizmor doesn't suggest adding it to renovate?

See prior discussion open-telemetry/opentelemetry-cpp-contrib#640

Thanks, that makes sense. I'm happy with that split. Could we disable Dependabot's regular updates where Renovate takes over? We can discuss the cooldown separately.

[thompson-tomo]

Yes, i usually like to do that once the renovate setup is confirmed end to end ie pr's raised to give confidence nothing is being missed.

Especially with the dependabot cooldown there is no issue running them side by side.

[lalitb]

Yes, i usually like to do that once the renovate setup is confirmed end to end ie pr's raised to give confidence nothing is being missed.

Especially with the dependabot cooldown there is no issue running them side by side.

Sounds good, thanks for clarifying. We can keep both temporarily while we confirm Renovate is working, then disable Dependabot's regular updates while keeping security updates enabled.

[thompson-tomo]

Correct & i will help monitor the rollout of it etc. Note i also have the pr for the build tools open-telemetry/cpp-build-tools#36

[marcalff]

LGTM