Add Renovate support

[mthalman]

Adds Renovate support via a pipeline that will keep configured dependencies up-to-date.

This initial configuration is set to use image digest pinning for the container images used in the builds. This is configured such that it will automatically update any image name in the tracked files so any new images that get manually added to this file can just reference the tag name and Renovate will do the rest by updating it to the digest on the next run.

My assumption is that we don't want digest pinning done for Helix images which would continue to be referenced by tag. Includes support for digest pinning on Helix images.

Example dry run (internal link)

Contributes to #113455

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Adds Renovate support to dotnet/runtime via an Azure DevOps pipeline, with an initial Renovate configuration focused on digest-pinning container images referenced by the shared pipeline-with-resources.yml template.

Changes:

• Add eng/renovate.json to configure Renovate with a custom regex manager for updating Docker image digests in pipeline-with-resources.yml.
• Add eng/pipelines/runtime-renovate.yml to run Renovate on a scheduled basis using the shared Arcade Renovate pipeline template.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
eng/renovate.json	Renovate configuration enabling a custom regex manager + digest pinning rules targeting the pipeline container image list.
eng/pipelines/runtime-renovate.yml	New scheduled pipeline that extends the shared Renovate stages template and points at eng/renovate.json.

[jkotas]

My assumption is that we don't want digest pinning done for Helix images which would continue to be referenced by tag.

Why not?

[mthalman]

My assumption is that we don't want digest pinning done for Helix images which would continue to be referenced by tag.

Why not?

I thought I recall from past conversations that that was the direction but I could be mistaken. It was a long time ago. I'm happy to broaden the scope.

[mthalman]

Also be aware that the context of why images are being updated will not be provided in the PR generated by Renovate. There's an issue logged to improve that: dotnet/arcade#16602