chore: one dependency bot, not two

[stxkxs]

The situation

This was the only repo in the org still running Dependabot. It owned the github-actions bumps while Renovate owned the chart pins, the Go module and the CI tool downloads — two tools splitting one job, in the one repo where the split was never revisited after Renovate arrived everywhere else.

(Worth recording how I nearly got this wrong: an gh api --jq '.name' sweep reported all 19 repos as having a dependabot.yml. On a 404 body that expression emits the string null, which a -n test reads as "present". Only this repo actually has one, and only this repo has Dependabot PRs.)

The change

Renovate now owns all four managers. .github/dependabot.yml is deleted and github-actions joins the enabledManagers allowlist.

This is not a like-for-like swap. The org preset sets pinDigests on github-actions, so actions get pinned to commit SHAs and kept there. Dependabot's config here did not do that — and SHA pinning is exactly why those pins had to be brought up to date by hand earlier. The tool now maintains what a person had to.

What stays local, and why

enabledManagers	an allowlist, not a default — this repo is a manifest catalog, and without it Renovate reads every values.yaml as a Helm chart it owns
4 custom managers	they find chart pins inside ApplicationSet matrix elements; no equivalent anywhere else in the org
labelling rules	chart / go / ci separation this repo's PR triage uses

Both of the first two are now described in the config itself rather than left to be inferred.

What the preset adds

Posture this config did not have at all: no automerge rules, no vulnerabilityAlerts block, no CVE packageRule, no osvVulnerabilityAlerts. It now gets patch/minor opening a PR, majors labelled for review, CVE-triggered updates excluded from automerge twice over, and OSV-based alerting on the Go module.

Docs

CLAUDE.md said Dependabot owned the actions bumps. It now says what is true.

Verified

• renovate-config-validator: valid, no migration needed
• task validate: all validations pass — helm-render, kustomize builds, ApplicationSet schema, sync waves, dashboard gate, policy-admission
• no open Dependabot PRs to strand

https://claude.ai/code/session_012iMnbboJuiUMSvu7n8oRhz

[github-actions]

CI Results

Check	Status
Zero-placeholder gate	✅ success
YAML Lint	✅ success
Dashboard gate (live grafana.com ids + AMG-saveable)	✅ success
Kyverno policy tests (+ verify-images contract)	✅ success
Fork-safety gate (no hardcoded org, blocking)	✅ success
Helm-render (every addon × every env)	✅ success
Policy-admission (Enforce-tier Kyverno vs the fleet)	✅ success
ApplicationSet schema + sync waves	✅ success
Appset render (Karpenter subnet selector)	✅ success
Secret scan (gitleaks)	✅ success
Render + assert + schema + misconfig (all environments)	✅ success

All checks passed.