Tooling: Add Renovate for automated dep updates

- Add `renovate.json` with weekly grouped non-major PRs (auto-merge) and monthly grouped major PRs (manual review)
- Remove `govulncheck` from check runner and CI (covered by Renovate)

Author: vdavid

.github/workflows/ci.yml

@@ -455,9 +455,6 @@ jobs:
             - name: Run nilaway
               run: ./scripts/check/check --check scripts-go-nilaway --ci
 
-            - name: Run govulncheck
-              run: ./scripts/check/check --check scripts-go-govulncheck --ci
-
             - name: Run deadcode
               run: ./scripts/check/check --check scripts-go-deadcode --ci
 

AGENTS.md

@@ -52,7 +52,7 @@ Run the smallest set of checks possible for efficiency while maintaining confide
   |svelte-check|knip|type-drift|svelte-tests|desktop-smoke|e2e-linux-typecheck|desktop-e2e-linux (slow)|rustfmt|clippy
   |cargo-audit|cargo-deny|cargo-udeps|jscpd-rust|cfg-gate|rust-tests|rust-tests-linux (slow)|license-server-prettier
   |license-server-eslint|license-server-typecheck|license-server-tests|gofmt|go-vet|staticcheck|ineffassign|misspell
-  |gocyclo|nilaway|govulncheck|deadcode|go-tests|website-prettier|website-eslint|website-typecheck|website-build
+  |gocyclo|nilaway|deadcode|go-tests|website-prettier|website-eslint|website-typecheck|website-build
   |website-e2e|docker-build|pnpm-audit|file-length}` (can use multiple `--check` flags or even a comma-separated list)
 - Run all: `./scripts/check.sh`. Runs all tests, linters, and formatters (with auto fixing) for all apps.
 - **E2E testing**: Full guide on Docker E2E, Playwright smoke tests, VNC debugging, fixture system:

renovate.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "schedule": ["before 6am on monday"],
+  "timezone": "Europe/Budapest",
+  "automerge": true,
+  "platformAutomerge": true,
+  "packageRules": [
+    {
+      "description": "Group all non-major updates into one weekly PR",
+      "groupName": "all non-major updates",
+      "matchUpdateTypes": ["patch", "minor", "pin", "digest"],
+      "automerge": true
+    },
+    {
+      "description": "Group all major updates into one monthly PR",
+      "groupName": "all major updates",
+      "matchUpdateTypes": ["major"],
+      "schedule": ["before 6am on the first day of the month"],
+      "automerge": false
+    },
+    {
+      "description": "Security patches get immediate PRs, auto-merge",
+      "matchCategories": ["security"],
+      "schedule": ["at any time"],
+      "automerge": true,
+      "groupName": null
+    }
+  ],
+  "cargo": {
+    "enabled": true
+  },
+  "gomod": {
+    "enabled": true
+  },
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "schedule": ["at any time"],
+    "automerge": true
+  }
+}

scripts/check/CLAUDE.md

@@ -100,7 +100,7 @@ Disabled by `--no-log` or `--ci`. Implementation in `stats.go`.
 | Website | Astro | prettier, eslint, typecheck, build, e2e |
 | Website | Docker | docker-build |
 | License server | TS | prettier, eslint, typecheck, tests |
-| Scripts | Go | gofmt, go-vet, staticcheck, ineffassign, misspell, gocyclo, nilaway, govulncheck, deadcode, go-tests |
+| Scripts | Go | gofmt, go-vet, staticcheck, ineffassign, misspell, gocyclo, nilaway, deadcode, go-tests |
 | Other | pnpm | pnpm-audit |
 | Other | Metrics | file-length (warn-only) |
 

scripts/check/checks/registry.go

@@ -348,15 +348,6 @@ var AllChecks = []CheckDefinition{
 		DependsOn:   []string{"scripts-go-vet"},
 		Run:         RunNilaway,
 	},
-	{
-		ID:          "scripts-go-govulncheck",
-		Nickname:    "govulncheck",
-		DisplayName: "govulncheck",
-		App:         AppScripts,
-		Tech:        "🐹 Go",
-		DependsOn:   nil,
-		Run:         RunGovulncheck,
-	},
 	{
 		ID:          "scripts-go-deadcode",
 		Nickname:    "deadcode",