From adb7bc47378774a1be631854b38c9988345a47e4 Mon Sep 17 00:00:00 2001
From: "renovate-rancher[bot]"
 <119870437+renovate-rancher[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:19:45 +0000
Subject: [PATCH] Add initial Renovate configuration

---
 .github/renovate.json                | 10 +++++
 .github/workflows/renovate-vault.yml | 57 ++++++++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 .github/renovate.json
 create mode 100644 .github/workflows/renovate-vault.yml

diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000000..59a2a803eb
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "github>rancher/renovate-config#release"
+  ],
+  "baseBranchPatterns": [
+    "master"
+  ],
+  "prHourlyLimit": 2
+}
diff --git a/.github/workflows/renovate-vault.yml b/.github/workflows/renovate-vault.yml
new file mode 100644
index 0000000000..49376720f9
--- /dev/null
+++ b/.github/workflows/renovate-vault.yml
@@ -0,0 +1,57 @@
+name: Renovate
+on:
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: "Override default log level"
+        required: false
+        default: info
+        type: choice
+        options:
+          - info
+          - debug
+      overrideSchedule:
+        description: "Override all schedules"
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+      configMigration:
+        description: "Toggle PRs for config migration"
+        required: false
+        default: "true"
+        type: choice
+        options:
+          - "false"
+          - "true"
+      renovateConfig:
+        description: "Define a custom renovate config file"
+        required: false
+        default: ".github/renovate.json"
+        type: string
+      minimumReleaseAge:
+        description: "Override minimumReleaseAge for a one-time run (e.g., '0 days' to disable delay)"
+        required: false
+        default: "null"
+        type: string
+
+  schedule:
+    - cron: '30 4,6 * * 1-5'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  call-workflow:
+    uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@922c8e762a46f551a064c44539923a3216b245be # v1.0.5
+    with:
+      configMigration: ${{ inputs.configMigration || 'true' }}
+      logLevel: ${{ inputs.logLevel || 'info' }}
+      overrideSchedule: ${{ github.event.inputs.overrideSchedule == 'true' && '{''schedule'':null}' || '' }}
+      renovateConfig: ${{ inputs.renovateConfig || '.github/renovate.json' }}
+      minimumReleaseAge: ${{ inputs.minimumReleaseAge || 'null' }}
+    secrets:
+      override-token: "${{ secrets.RENOVATE_FORK_GH_TOKEN || '' }}"