chore(ci): add Renovate baseline config

[pfe-nazaries]

Context

Prowler ships seven dependency ecosystems (Poetry SDK, uv API + MCP, pnpm UI, root pip, Docker, GitHub Actions, Helm, pre-commit) but only root pip and github-actions are automated today — monthly via the partly-disabled .github/dependabot.yml. Everything else moves by hand, so security updates lag, cadence is ad-hoc, and CODEOWNERS/labeler infrastructure is under-leveraged.

This PR introduces the Renovate baseline declared in openspec/changes/add-renovate-config/ (proposal, design, specs). The config is inert until an org admin installs the Mend Renovate App on prowler-cloud/prowler — follow-up step tracked in the OpenSpec change § 3.

Description

Adds three pieces of CI infrastructure:

1. .github/renovate.json — baseline config extending config:best-practices plus five additional targeted presets (:enablePreCommit, security:openssf-scorecard, docker:enableMajor, customManagers:githubActionsVersions, customManagers:dockerfileVersions) and four helpers (:semanticCommits, :enableVulnerabilityAlertsWithLabel(security), helpers:pinGitHubActionDigestsToSemver, helpers:disableTypesNodeMajor). Key behaviors:

   • Cadence staggered by update type + week in cron form interpreted in Europe/Madrid: patches on day 1, minors on day 8 (every 2 months), majors on day 15 (every 3 months), all in the 22:00–06:00 overnight window.
   • Vulnerability alerts bypass everything operational: schedule (via :enableVulnerabilityAlertsWithLabel(security)) AND rate caps (via vulnerabilityAlerts: { prHourlyLimit: 0, prConcurrentLimit: 0 }). For a security product, a coordinated CVE disclosure burst must never be throttled by the normal operational queue (default rate caps of 2 PRs/hour and 10 concurrent PRs).
   • Grouping by CODEOWNERS team: github-actions, docker, pre-commit hooks, helm charts, plus per-component Python + UI groups.
   • semanticCommitScope per component: ui / api / mcp / sdk / ci / docker / pre-commit / helm (matches the repo's commit convention, not Renovate's default deps).
   • no-changelog label auto-applied only to non-user-facing categories (github-actions, docker, pre-commit hooks, helm charts, lockfile maintenance, UI devDependencies).
   • Other globals: minimumReleaseAge: 7 days, rangeStrategy: pin, prConcurrentLimit: 10, prHourlyLimit: 2, baseBranches: ["master"], no auto-merge.

2. .pre-commit-config.yaml — adds the official renovatebot/pre-commit-hooks@43.150.0 renovate-config-validator hook scoped to ^\.github/renovate\.json$. Renovate's pre-commit manager (enabled via :enablePreCommit) will track and bump this rev: alongside the rest of the pre-commit hook bumps.

3. .github/workflows/renovate-config-validate.yml — mirror gate for contributors without a local prek installation. Triggers on PRs touching .github/renovate.json or .pre-commit-config.yaml. Runs the same hook via prek run renovate-config-validator, with prek itself pinned via PREK_VERSION: '0.4.0' env (tracked by customManagers:githubActionsVersions). All action uses: are SHA-pinned per repo convention; passes zizmor audit.

Full rationale and decision log is in openspec/changes/add-renovate-config/design.md (D1–D12) and the spec deltas in openspec/changes/add-renovate-config/specs/ci-dependency-automation/spec.md.

This branch also includes a small maintenance commit unrelated to Renovate itself: chore(worktree): include openspec/ in copy-ignored allowlist.

Steps to review

1. Read openspec/changes/add-renovate-config/proposal.md for the why and design.md § D1–D12 for each decision (presets selected, presets intentionally absent, scheduling, grouping, scopes, validation gate, vulnerability alerts bypass).
2. Cross-check .github/renovate.json against the design's reference config and against specs/ci-dependency-automation/spec.md requirements.
3. Validate locally: prek run renovate-config-validator --files .github/renovate.json — must exit zero. Break a closing brace to confirm it exits non-zero.
4. Confirm conventional-commit compatibility: every PR Renovate would open uses chore(<scope>): … titles; sample titles in design.md § D11 mapping table.
5. Confirm pinning posture: global "rangeStrategy": "pin" plus inherited docker:pinDigests and :pinDevDependencies from config:best-practices plus helpers:pinGitHubActionDigestsToSemver for GH Actions SHA-pins with # v<semver> comments preserved.
6. Confirm security posture: vulnerabilityAlerts: { prHourlyLimit: 0, prConcurrentLimit: 0 } exempts CVE-driven PRs from the operational rate caps so a coordinated disclosure burst is never queued behind routine bumps.
7. Activation step (post-merge): an org admin installs the Mend Renovate App on prowler-cloud/prowler. Tasks § 3 in the OpenSpec change list the follow-up verification.

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com
• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests — renovate-config-validator (pre-commit + CI workflow) acts as the schema test for .github/renovate.json; zizmor audit covers the new workflow.
• Review if code is being documented — proposal, design (D1–D12), and spec deltas under openspec/changes/add-renovate-config/.
• Review if backport is needed — N/A, baseBranches: ["master"] only by design (see § D8).
• Review if is needed to change the Readme.md — N/A, no user-facing change.
• Ensure new entries are added to CHANGELOG.md, if applicable — N/A, PR carries no-changelog label (CI tooling only).

SDK/CLI

• Are there new checks included in this PR? No. N/A.

UI

• All issue/task requirements work as expected on the UI — N/A, no UI runtime change.
• If this PR adds or updates npm dependencies, include package-health evidence — N/A, no ui/package.json change.
• Screenshots/Video — N/A.

API

• All issue/task requirements work as expected on the API — N/A.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.