backport(release-3.21): Renovate bot auto-merge (#2227)

* backport: Renovate bot auto-merge

* add additional labels

Author: tommartensen

.github/CODEOWNERS

@@ -8,8 +8,10 @@
 RELEASED_VERSIONS               @stackrox/collector-team
 RELEASED_VERSIONS.unsupported   @stackrox/collector-team
 
-# The RHTAP maintainers for ACS review all changes related to the Konflux (f.k.a. RHTAP) pipelines, such as new
+# The RHTAP maintainers for ACS review all changes related to the Konflux pipelines, such as new
 # pipelines, parameter changes or automated task updates as well as Dockerfile updates.
-**/konflux.*Dockerfile  @stackrox/rhtap-maintainers
-/.tekton/               @stackrox/rhtap-maintainers
-rpms.*                  @stackrox/rhtap-maintainers
+# rhacs-bot auto-approves MintMaker PRs for automated task and security updates.
+**/konflux.*Dockerfile  @stackrox/rhtap-maintainers @rhacs-bot
+/.tekton/               @stackrox/rhtap-maintainers @rhacs-bot
+rpms.*                  @stackrox/rhtap-maintainers @rhacs-bot
+.github/renovate.json5  @stackrox/rhtap-maintainers

.github/renovate.json5

@@ -71,4 +71,18 @@
     "dockerfile",
     "rpm",
   ],
+  "packageRules": [{
+    "matchPackageNames": ["/.*/"],
+    "groupName": "All updates",
+    "automerge": true,
+    // A known issue is that some non-Konflux CI jobs in currently fail, which may prevent successful auto-merging with a "branch" auto-merge setting.
+    // Therefore, we use PR merge type and have automation approve PRs.
+    "automergeType": "pr",
+    "automergeStrategy": "squash",
+    // Tell Renovate that it can automerge branches at any time of the day.
+    "automergeSchedule": [
+      "at any time"
+    ],
+  }],
+  "labels": ["auto-approve", "build-builder-image","rebuild-test-container"],
 }

.github/workflows/auto-approve.yml

@@ -0,0 +1,20 @@
+name: auto-merge
+
+on:
+  pull_request_target:
+    types:
+    - labeled
+
+jobs:
+  auto-approve:
+    name: Auto-approve Konflux updates
+    runs-on: ubuntu-latest
+    if: github.actor == 'red-hat-konflux[bot]' && github.event.label.name == 'auto-approve'
+    steps:
+    - env:
+        GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
+      run: |
+        set -euo pipefail
+        gh pr review ${{ github.event.pull_request.number }} \
+          --approve --body "Auto-approved by automation." \
+          --repo "${{ github.repository }}"