[vaibhavatlan]

What

• Adds renovate.json, which extends the same fleet preset application-sdk uses (github>atlanhq/application-sdk//renovate-config/default.json). Overrides cover where pyatlan differs.
• Removes .github/dependabot.yml (daily pip + github-actions version updates) so Renovate and Dependabot don't open duplicate PRs. Dependabot alerts are untouched; Renovate's vulnerability PRs read them.

The Mend Renovate app is already installed here. Merging this onboards the repo, and Mend then closes its stale onboarding PR #1029.

What you get from the preset

• Third-party PyPI minor/patch updates grouped into one "non-critical python dependencies" PR, held for a 3-day release age. pyatlan/SDK first-party packages are exempt.
• Vulnerability PRs with no cooldown.
• github-actions updates grouped and auto-merged (minor/patch/digest).
• Lock-file maintenance.

pyatlan-specific overrides (and why)

Override	Reason
platformAutomerge: false everywhere	main has no required status checks (the only ruleset is Copilot review). GitHub native auto-merge waits only for required checks, so it would merge red PRs. With this off, Renovate merges itself, and only when every check is green. Flip it back once main requires the pyatlan-pr checks.
Lock maintenance: weekly, reviewed, postUpgradeTasks.commands: []	The preset bounds lock refreshes with renovate-uv-lock-bounded, which exists only on the self-hosted fleet runner. This repo runs on Mend, which would publish a permanent red renovate/artifacts (the same override application-sdk carries). Without that bound, transitive packages have no release-age hold, so a human reviews the lock PR.
py3.9 pins disabled (matchJsonata, 14 lines)	Renovate's pep621 manager ignores python_version markers. A lookup dry-run proposed moving the < '3.10' lines to their ≥3.10 twins' versions (pydantic ~=2.13.4 → ~=2.14.2, pytest ~=8.4.2 → ~=9.2.0, …). The universal uv lock would then fail, and so would the whole grouped PR. The ≥3.10 lines keep updating. When a held pin is moved by hand, update its entry.
github-actions python dep disabled	The dry-run proposed python-version 3.9/3.11/3.12 → 3.15 in the auto-merged actions group. Those pins are support-matrix decisions.
github-actions majors reviewed; 3-day hold on action releases	pyatlan-pr.yaml skips the test jobs for .github/-only PRs, so green doesn't mean the bumped action ran. The preset's cooldown covers only PyPI.

Verification

• renovate-config-validator (renovate@44.3.2, the fleet-pinned version): passes.
• renovate --platform=local --dry-run=lookup against this branch: all 14 marker-held lines and all 11 CI python pins report disabled. Their ≥3.10 twins and the action bumps are still proposed, and fresh releases are held by the 3-day window.

Auto-merge (second commit)

• Dev/docs deps ([dependency-groups]) minor/patch auto-merge. They never ship in the wheel. With platformAutomerge: false, Renovate merges the PR itself, and only when every check on the branch is green (unit/QA 3.9–3.14, vuln scans, integration tests). A red or pending check blocks it.
• Runtime deps ([project].dependencies) get their own reviewed group (runtime python dependencies). A range change there reaches every consumer. It's a separate group because Renovate auto-merges a group only if every member does. Dry-run confirms the split: renovate/non-critical-python-dependencies (dev/docs) vs renovate/runtime-python-dependencies.
• Auto-merged today: github-actions minor/patch/digest, dev/docs minor/patch. Reviewed: majors, runtime deps, weekly lock refresh.

Needs a repo admin

1. Add a ruleset on main requiring the pyatlan-pr checks (e.g. qa-checks-and-unit-tests (3.9) … (3.14), vulnerability-scan (…)). After that, platformAutomerge can go back to true.
2. Confirm Dependabot alerts are enabled. Decide whether to turn off Dependabot security updates (repo setting), which would duplicate Renovate's vulnerability PRs.

After merge: close the 7 stale Dependabot PRs.

🤖 Generated with Claude Code

[linear]

FND-4522