Add Renovate config (Gradle + Docker) + metadata regen workflow

[jonbartels]

Summary

Adds Renovate dependency automation to the repo, covering both the Gradle build and Dockerfiles.

renovate.json

• Extends config:recommended.
• Runs on a monthly schedule (before 6am on the 1st) with a 2-day minimumReleaseAge to avoid churny/yanked releases.
• prConcurrentLimit: 10, dependency dashboard enabled, semantic commits, OSV vulnerability alerts.
• Ecosystem labels: dependencies on everything, plus java (Gradle) / docker (Dockerfile).
• A catch-all group bundles all ungrouped minor/patch bumps into one PR (all-minor-and-patch); majors stay individual.
• Family groups keep related libraries bumped together: aws-sdk, jetty, jersey, jackson, netty, log4j, apache-commons, test-tooling.

.github/workflows/renovate-verification-metadata.yaml

Fallback workflow that regenerates gradle/verification-metadata.xml on renovate/** branches, in case the Mend-hosted Renovate app does not regenerate it itself (its command allowlist / PGP handling is unconfirmed for this repo).

It uses a split-privilege design:

• regen job runs the newly-bumped (untrusted) dependency code with a read-only token and no secrets, then uploads the refreshed metadata as an artifact.
• commit job runs no dependency code, downloads the artifact, and pushes it back with a writable token.

This keeps a writable token from ever coexisting with untrusted code execution. Delete this workflow once Renovate is confirmed to regenerate the metadata (incl. PGP + full config coverage) on its own.

Manual steps to enable Renovate on this fork

Renovate config in the repo does nothing until the bot is installed. To turn it on for jonbartels/oie-engine:

1. Install the Renovate GitHub App — go to https://github.com/apps/renovate and click Install (or Configure if already installed on your account).
2. Grant it access to the jonbartels/oie-engine repository (select "Only select repositories" → pick this repo, or "All repositories").
3. Onboarding PR — Renovate scans the repo. Because renovate.json already exists, it skips the "Configure Renovate" onboarding PR and starts using this config directly. (If no config were present, it would open an onboarding PR first.)
4. Check the Dependency Dashboard — an issue titled "Dependency Dashboard" appears in the repo; it lists detected updates and lets you trigger PRs on demand.
5. First run timing — with the monthly schedule, Renovate only opens update PRs before 6am on the 1st of the month. To test sooner, either temporarily remove the schedule field, or tick a checkbox on the Dependency Dashboard to force a PR.
6. (Optional) Self-hosted alternative — instead of the hosted app you can run the renovatebot/github-action on a cron; the hosted app is simpler and is what this config assumes.

No repository secrets are required for the hosted app. The verification-metadata workflow uses the default GITHUB_TOKEN only (with per-job least-privilege scopes), so nothing extra to configure there.

🤖 Generated with Claude Code