Replace Dependabot with Renovate and add a stable CI gate

[kylehoehns]

What this does

Swaps Dependabot for Renovate, and adds one new CI job that branch protection can point at.

Why we're switching

Two reasons.

Our Dependabot config was quietly broken. It lists the folders to check by hand, and some of those folders don't exist anymore:

Config said	What's actually there
maven in /java	build.gradle — there is no pom.xml in this repo at all
nuget in /c-sharp/Check	that folder is now c-sharp/Application
nuget in /c-sharp/Check.Tests	that folder is now c-sharp/UnitTests

And f-sharp, aws-terraform, docker-compose.yml, and cpp were never listed at all. So four of our twelve exercises have never gotten a single dependency update, and Java and C# stopped getting them the day those folders were renamed. Nothing failed loudly — Dependabot just skips folders it can't find.

You can see it in the PR history. Java has had 1 Dependabot PR ever. C# had 9, all before the rename. Meanwhile typescript-react has had 149.

Renovate finds dependency files by scanning the repo instead of reading a list of folders. So there's no list to go stale, and it picks up the four exercises we were missing. It also spotted that cpp is pinned to googletest 1.14.0, which is about three years old.

We want dependency PRs to merge themselves. Dependabot can't do this. It has no auto-merge setting, and in January GitHub removed the @dependabot merge comment command that people used as a workaround. Renovate has auto-merge built in, and we already run it on hacker-rank-queue.

How it'll work

Renovate opens about one PR a month with all the non-major updates grouped together. If the full devcontainer matrix passes, it merges itself.

Major version bumps get their own separate PR, but those merge themselves too. These exercises are small starter shells, not real applications, so a major bump that still compiles and passes its tests is good enough. Keeping majors in their own PR means that if one does break, it's isolated to the dependency that caused it instead of blocking everything else. A major that needs real code changes will just fail CI and sit there as an open PR, which is a useful signal that an exercise needs attention.

There's a 14-day waiting period before any update can auto-merge. If a package gets compromised, it usually gets pulled well inside two weeks, so this keeps us from auto-merging something bad on day one.

We also stop ignoring patch updates. That made sense when every PR needed someone to click merge. Now that they merge themselves, patches are the safest thing we get.

The new verify-complete job

Our verify-job check names include the devcontainer path, like verify-job (.devcontainer/cpp/devcontainer.json). Those names change whenever someone adds or removes a devcontainer, so branch protection can't require them by name — a required check that never runs would block every PR forever.

verify-complete is one job with one stable name that passes only if everything else passed. That's what branch protection will require.

Still to do after this merges

These are repo settings, not code, so they aren't in this PR:

• Turn on Allow auto-merge (Renovate can't merge anything without it)
• Delete the classic branch protection on main and move to rulesets — the two are additive, and the old rule's "1 approval" has no way to let Renovate through
• Ruleset 1: require verify-complete, nobody bypasses
• Ruleset 2: require 1 approval, Renovate bypasses
• Add sourceallies/interviews to the Renovate GitHub App

Humans still need an approval. Renovate skips that rule but still has to pass CI.

Note on the open PRs

The ~30 open Dependabot PRs can be closed. Renovate will reopen what still matters on its first run, grouped, at current versions.