feat(checks): Renovate checks

[abkfenris]

Adds an initial set of checks for Renovate equal to GH200 (REN200 is there a config) and GH210 (REN210 - basic management of GitHub Actions).

Made a choice that as long as there was either Renovate or Dependabot configured, repo review should pass out of the box. To do that added DEP200 that will pass if either a Renovate or Dependabot config exists, and made REN200 and GH200 return None to skip them and downstream checks.

Tries to read all non package.json locations (which is deprecated). Uses a preprocessor to strip comments and trailing commas which supports most of the renovate config varieties. An optional dependency on the pure Python json5 library takes care of the rest.

Closes #463 #740

---

📚 Documentation preview 📚: https://scientific-python-cookie--823.org.readthedocs.build/

[abkfenris]

I manually tested against a range of repos with different renovate configs and locations, some from #463 and others randomly found by searching Github.

Here are roughly the ones per format that I tried:

SUPPORTED_RENOVATE_FILES = [
    "renovate.json",  # gulfofmaine/climatology_py_dash
    "renovate.jsonc",  # jumpstarter-dev/jumpstarter
    "renovate.json5",  # SonarSource/docker-sonarqube
    ".github/renovate.json",  # adobe/spectrum-css
    ".github/renovate.jsonc",
    ".github/renovate.json5",  # paddyroddy/.github
    ".gitlab/renovate.json",  # zammad/zammad
    ".gitlab/renovate.jsonc",
    ".gitlab/renovate.json5",
    ".renovaterc",  #     prettier/eslint-config-prettier
    ".renovaterc.json",  # Esri/calcite-design-system
    ".renovaterc.jsonc",
    ".renovaterc.json5",
    # "package.json"  # Deprecated, renovate is a field within the file
]

Also

• https://github.com/ruby-shoryuken/shoryuken
• And more that I've now lost track of.

There were some of the .jsonc and .json5 that didn't have anything special and were able to be parsed by the standard lib json module, so I didn't disable the formats. Any that throw an error opening are treated as empty configs.

It looks like json5 might be a relatively common config variant, but I didn't want to add a dependency for this first pass.

I also only checked for directly enabling GitHub actions, or that it's in two common presets. If there are other common presets that should be included those can be added, but for less common presets, REN210 might need to be disabled.

[henryiii]

I wonder if we can support jsonc with a little preprocessing? Stripping comments should be easy, trailing commas less so. Any dependencies we take on must support Pyodide. I haven't used renovate so can't be of too much help.

[abkfenris]

I can try giving a preprocessor a shot.

What about making https://pypi.org/project/json5/ an optional dependency? It's supposedly not fast, but it is pure Python. I could structure it so that we try preprocessing first, and then fall back to json5 if it's available.

[henryiii]

I doubt speed is that important. I'd be fine with json5 as a dependency.

[abkfenris]

Ok, added a preprocessor default, and an optional dependency for full json5 support.