Add dependency management with Dependabot and Renovate

[Copilot]

Overview

This PR adds comprehensive dependency management configuration for the repository, enabling automated updates for GitHub Actions, Helm chart dependencies, and Docker images.

Changes

1. Enhanced Dependabot Configuration

Updated .github/dependabot.yml to include:

• Improved commit message formatting with chore(deps) prefix and scope inclusion
• Continued monitoring of GitHub Actions dependencies

Note: Dependabot has limited support for Helm charts and cannot track Helm chart dependencies in Chart.yaml or Docker images in values.yaml files.

2. Added Renovate Configuration

Created renovate.json with comprehensive settings for:

• Helm chart dependencies (in Chart.yaml files)
• Docker images (in values.yaml and template files)
• GitHub Actions (in .github/workflows/)
• Kubernetes manifests

Key features:

• Dependency dashboard for tracking all pending updates
• Semantic commits following conventional commit format
• Scheduled weekly runs (Mondays before 4am) to minimize disruption
• Rate limiting (5 concurrent PRs max, 2 per hour)
• Intelligent grouping of related updates

3. Comprehensive Documentation

Added DEPENDENCY_MANAGEMENT.md with:

• Step-by-step activation instructions for both tools
• Feature comparison table
• Configuration customization guide
• Troubleshooting section
• Best practice recommendations

Updated README.md with a reference to the dependency management documentation.

How to Activate

Dependabot

Dependabot is automatically enabled for GitHub repositories. Verify it's active in Settings → Security → Code security and analysis.

Renovate (Recommended)

1. Install the Renovate GitHub App for the organization/repository
2. Grant it access to this repository
3. Renovate will automatically detect the renovate.json configuration and start creating pull requests

Recommendations

For this Helm charts repository:

• Use both tools: Dependabot for GitHub Actions (built-in, free) + Renovate for Helm-specific updates
• Renovate provides the most value as it has native support for Helm chart dependencies and Docker image updates in values.yaml files

Validation

All configuration files have been validated:

• ✅ renovate.json is valid JSON and conforms to Renovate schema
• ✅ .github/dependabot.yml is valid YAML and follows Dependabot specification

Fixes the issue of activating dependency management for the project.

Original prompt

how do I activate dependebot on this project ? Or renovate

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.