chore: enable auto-merges by Renovate bot (#2197)

* chore: enable auto-merges by Renovate bot

* validate renovate

* Add renovate to CODEOWNERS

Author: tommartensen

.github/CODEOWNERS

@@ -13,3 +13,4 @@ RELEASED_VERSIONS.unsupported   @stackrox/collector-team
 **/konflux.*Dockerfile  @stackrox/rhtap-maintainers
 /.tekton/               @stackrox/rhtap-maintainers
 rpms.*                  @stackrox/rhtap-maintainers
+.github/renovate.json5  @stackrox/rhtap-maintainers

.github/renovate.json5

@@ -71,4 +71,18 @@
     "dockerfile",
     "rpm",
   ],
+  "packageRules": [{
+    "matchPackageNames": ["/.*/"],
+    "groupName": "All updates",
+    "automerge": true,
+    // A known issue is that some non-Konflux CI jobs in currently fail, which may prevent successful auto-merging with a "branch" auto-merge setting.
+    // Therefore, we use PR merge type and have automation approve PRs.
+    "automergeType": "pr",
+    "automergeStrategy": "squash",
+    // Tell Renovate that it can automerge branches at any time of the day.
+    "automergeSchedule": [
+      "at any time"
+    ],
+  }],
+  "labels": ["auto-approve"],
 }

.github/workflows/auto-approve.yml

@@ -0,0 +1,18 @@
+name: auto-merge
+
+on:
+  pull_request_target:
+    types:
+    - labeled
+
+jobs:
+  auto-approve:
+    name: Auto-approve Konflux updates
+    runs-on: ubuntu-latest
+    if: github.actor == 'red-hat-konflux[bot]' && github.event.label.name == 'auto-approve'
+    steps:
+    - env:
+        GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
+      run: |
+        set -euo pipefail
+        gh pr review ${{ github.event.pull_request.number }} --approve --body "Auto-approved by automation."