feat: add reusable renovate-auto-approve workflow

[cbrgm]

What

Adds a reusable renovate-auto-approve.yml workflow to dev-kit, plus an example caller and an onboarding note.

Why

We want Renovate to auto-merge digest/patch/minor PRs without a manual approval. The renovate-config presets already set automerge: true and add an automerge label to those update types, but Renovate cant approve its own PRs, so the required-review gate never clears. This workflow provides the approval for labeled PRs and revokes it if a PR later turns out to be a security one.

Originally i put this in renovate-config (opendefensecloud/renovate-config#14), but dev-kit is the better home: it already owns the shared CI workflows and the repo-settings governance (labels, merge strategy, the protect-main ruleset). renovate-config keeps the policy (which update types are eligible), dev-kit hosts the workflow that acts on it. So renovate-config#14 now just points its caller at dev-kit.

Context: opendefensecloud/solution-arsenal#580.

Testing

Linted the reusable workflow (the one that actually runs in this repo):

$ actionlint .github/workflows/renovate-auto-approve.yml
(no findings)

The example/ copy is a template (GitHub only runs workflows under .github/workflows/, not example/...), so it never executes here. The @<sha-or-tag> ref is an intentional placeholder consumers pin when they copy it. End-to-end automerge can only be exercised on a real Renovate PR in a consuming repo with the GitHub settings applied.

Notes for reviewers

• Follow-up worth considering: teach make repo-settings to also flip "Allow GitHub Actions to create and approve pull requests" so it isnt a manual step. Left out here to keep this PR focused. Can open an issue if we want it.
• Pairs with feat: enable automerge for digest, patch, and minor renovate updates renovate-config#14 (repoints the caller to dev-kit). Merge order doesnt matter, nothing runs until a consuming repo adds the caller.

Checklist

• Tests added/updated (workflow linted with actionlint; no runtime harness for a reusable workflow in this repo)
• No breaking changes (new opt-in workflow; nothing runs until a repo copies the caller)
• Readable commit history
• AI code review considered and comments resolved

Summary by CodeRabbit

• New Features

  • Added automated approval for eligible Renovate update pull requests labeled for auto-merge.
  • Automatically withdraws approval when a security-related label is applied.
  • Keeps merging subject to required status checks and configurable workflow settings.
  • Added an example configuration for enabling the automation in a repository.

• Documentation

  • Added setup guidance, permission requirements, status-check configuration, and update eligibility details to the repository checklist.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change adds a reusable GitHub Actions workflow for conditional Renovate pull request approval. It adds an example caller workflow and documents required permissions, status checks, update eligibility, and setup steps.

Changes

Renovate auto-approval

Layer / File(s)	Summary
Reusable workflow contract and approval decision .github/workflows/renovate-auto-approve.yml	The workflow accepts configurable labels and a Renovate actor. It approves eligible pull requests, avoids duplicate approvals, and requests changes when a blocking label follows approval.
Caller workflow and repository setup example/.github/workflows/renovate-auto-approve.yml, docs/NEW_REPO.md	The example workflow handles pull request events and calls the reusable workflow. The documentation defines required permissions, status checks, update eligibility, and checklist setup.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub as GitHub pull request
  participant Caller as Example workflow
  participant Reusable as Reusable workflow
  participant Reviews as GitHub reviews

  GitHub->>Caller: opened, reopened, synchronized, or labeled event
  Caller->>Reusable: invoke with pull-request write permission
  Reusable->>Reviews: inspect latest automated review
  Reviews-->>Reusable: review state
  Reusable->>Reviews: approve or request changes

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding a reusable Renovate auto-approval workflow.
Description check	✅ Passed	The description covers the required sections and explains the motivation, testing, reviewer notes, and checklist completion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/renovate-auto-approve

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/renovate-auto-approve.yml:
- Around line 41-45: Update the workflow around the review mutation steps to
re-query current pull-request labels immediately before every gh pr review call,
preventing stale HAS_BLOCK state from approving blocked PRs. Configure
concurrency using the repository and pull request number, with
cancel-in-progress enabled, so overlapping runs for the same PR are serialized.

In `@example/.github/workflows/renovate-auto-approve.yml`:
- Around line 5-7: Update the pull_request event configuration to include the
unlabeled activity type alongside the existing opened, reopened, synchronize,
and labeled triggers, so removing the security label re-evaluates the workflow.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e60e05d-a9d0-4cd1-b421-83bff521d78d

📥 Commits

Reviewing files that changed from the base of the PR and between 170f07a and fbf0e19.

📒 Files selected for processing (3)

• .github/workflows/renovate-auto-approve.yml
• docs/NEW_REPO.md
• example/.github/workflows/renovate-auto-approve.yml

[olzemal]

Minor suggestion, otherwise lgtm.