ci: switch dependency update automation from Dependabot to Renovate

[Yicong-Huang]

What changes were proposed in this PR?

Replace Dependabot version updates with Renovate (Mend "Forking Renovate" app), as used by other ASF projects (Polaris, Fineract, JMeter, Solr):

• Add .github/renovate.json5 carrying over the dependabot.yml semantics: weekly Monday cadence; patch and minor bumps grouped into per-area PRs (except sbt minors, which stay individual so CI failures remain attributable); majors as individual PRs; Angular majors excluded (guided ng update, chore(deps): align Angular packages, CLI toolchain to 21.2.18 #6155), per-area conventional-commit scopes. Only the previously covered ecosystems are enabled (npm, bun, sbt, pip_requirements, github-actions).
• Pin pandas / numpy / pyarrow and the JVM org.apache.arrow:* artifacts (Arrow IPC data path between the JVM engine and Python workers; upgraded manually and in lockstep).
• Remove .github/dependabot.yml.

What Renovate adds that Dependabot cannot do:

1. PRs come from the bot's fork instead of dependabot/... branches in this repo.
2. Security-fix PRs are typed fix(...) + security and release/v1.2 (backport marker) labels, while routine bumps are chore(...) (Dependabot's commit-message.prefix cannot distinguish the two).
3. Vulnerability detection via OSV (osvVulnerabilityAlerts), so no Dependabot-alerts read permission is needed.
4. Mature sbt support vs. Dependabot's beta.

Merge prerequisite: the Forking Renovate app must be enabled for this repo (INFRA ticket, read-only app; no bot token or write access involved). Until then this config is inert. Dependabot alerts (detection in the Security tab; .asf.yaml dependabot_alerts: true) are unaffected. Renovate takes over both version updates and security-fix PRs (via OSV).

Any related issues, documentation, discussions?

Closes #6847

INFRA ticket: https://issues.apache.org/jira/browse/INFRA-28167

How was this PR tested?

• renovate-config-validator passes.
• Local dry-run (renovate --platform=local, debug log): all 5 managers extract (675 deps, 52 files); patch/minor groups form per area while sbt minors and majors stay individual; Angular majors filtered as disabled; pinned Arrow-path packages produce no updates; OSV flags torch/setuptools and keeps their fixes as separate vulnerability branches.
• Final PR title/label rendering happens at branch-creation time, which local mode skips; will be watched on the first real run after INFRA enables the app.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-fable-5)

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• No candidates found from git blame history.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.30%. Comparing base (3149eb5) to head (b3d4505).
⚠️ Report is 14 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #6848      +/-   ##
============================================
+ Coverage     76.44%   77.30%   +0.86%     
- Complexity     3456     3524      +68     
============================================
  Files          1161     1161              
  Lines         45922    45922              
  Branches       5101     5101              
============================================
+ Hits          35105    35502     +397     
+ Misses         9269     8839     -430     
- Partials       1548     1581      +33     

Flag	Coverage Δ
access-control-service	70.00% <ø> (ø)
agent-service	76.76% <ø> (ø)
amber	69.10% <ø> (+1.76%)	⬆️
computing-unit-managing-service	20.49% <ø> (ø)
config-service	66.66% <ø> (ø)
file-service	67.21% <ø> (ø)
frontend	82.58% <ø> (+0.48%)	⬆️
notebook-migration-service	78.94% <ø> (ø)
pyamber	92.15% <ø> (ø)
workflow-compiling-service	55.14% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Benchmark changes need a look

🟢 2 better · 🔴 8 worse · ⚪ 5 noise (<±5%) · 0 without baseline

Compared against main 3149eb5 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	397	0.242	24,840/32,020/32,020 us	🔴 +8.9% / 🔴 +93.8%
🔴	bs=100 sw=10 sl=64	784	0.479	126,675/159,586/159,586 us	🔴 +20.5% / 🔴 +46.3%
⚪	bs=1000 sw=10 sl=64	929	0.567	1,081,204/1,106,287/1,106,287 us	⚪ within ±5% / 🔴 +7.9%

Baseline details

Latest main 3149eb5 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	397 tuples/sec	429 tuples/sec	754.55 tuples/sec	-7.5%	-47.4%
bs=10 sw=10 sl=64	MB/s	0.242 MB/s	0.262 MB/s	0.461 MB/s	-7.6%	-47.5%
bs=10 sw=10 sl=64	p50	24,840 us	22,801 us	12,816 us	+8.9%	+93.8%
bs=10 sw=10 sl=64	p95	32,020 us	34,592 us	16,594 us	-7.4%	+93.0%
bs=10 sw=10 sl=64	p99	32,020 us	34,592 us	19,806 us	-7.4%	+61.7%
bs=100 sw=10 sl=64	throughput	784 tuples/sec	830 tuples/sec	969.38 tuples/sec	-5.5%	-19.1%
bs=100 sw=10 sl=64	MB/s	0.479 MB/s	0.507 MB/s	0.592 MB/s	-5.5%	-19.0%
bs=100 sw=10 sl=64	p50	126,675 us	119,439 us	103,584 us	+6.1%	+22.3%
bs=100 sw=10 sl=64	p95	159,586 us	132,469 us	109,097 us	+20.5%	+46.3%
bs=100 sw=10 sl=64	p99	159,586 us	132,469 us	117,304 us	+20.5%	+36.0%
bs=1000 sw=10 sl=64	throughput	929 tuples/sec	930 tuples/sec	1,004 tuples/sec	-0.1%	-7.4%
bs=1000 sw=10 sl=64	MB/s	0.567 MB/s	0.567 MB/s	0.613 MB/s	0.0%	-7.4%
bs=1000 sw=10 sl=64	p50	1,081,204 us	1,073,580 us	1,002,357 us	+0.7%	+7.9%
bs=1000 sw=10 sl=64	p95	1,106,287 us	1,116,384 us	1,046,463 us	-0.9%	+5.7%
bs=1000 sw=10 sl=64	p99	1,106,287 us	1,116,384 us	1,073,661 us	-0.9%	+3.0%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,503.53,200,128000,397,0.242,24840.44,32020.44,32020.44
1,100,10,64,20,2550.85,2000,1280000,784,0.479,126675.24,159585.72,159585.72
2,1000,10,64,20,21522.62,20000,12800000,929,0.567,1081204.45,1106286.53,1106286.53

[Yicong-Huang]

INFRA ticket opened https://issues.apache.org/jira/browse/INFRA-28167

[aglinxinyuan]

LGTM!

[Copilot]

Pull request overview

This PR migrates Texera’s automated dependency update tooling from GitHub Dependabot version-update PRs to Renovate (Mend “Forking Renovate” app), keeping the existing weekly cadence and introducing Renovate-only capabilities like OSV-based vulnerability PRs and richer grouping/commit metadata.

Changes:

• Added a Renovate configuration (.github/renovate.json5) to define schedules, grouping rules, semantic commit conventions, and package exclusions (Arrow-path + Angular majors).
• Enabled OSV vulnerability alerts with dedicated labeling/commit typing for security fixes.
• Removed the existing Dependabot version-update configuration (.github/dependabot.yml).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/renovate.json5	Introduces Renovate configuration (managers, schedule, grouping rules, semantic commits, vulnerability alert behavior, and pinned/excluded packages).
.github/dependabot.yml	Removes Dependabot version-update automation configuration in favor of Renovate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.