revert: undo the Renovate session and pause automation

.github/workflows/ci-fast.yml

@@ -25,9 +25,6 @@ jobs:
       startsWith(github.event.head_commit.message, 'chore: release '))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - name: Check Renovate lockfile classification
-        run: bash scripts/repair-renovate-lockfiles.test.sh
       - name: Validate PR title and branch
         if: github.event_name == 'pull_request'
         env:
@@ -40,10 +37,7 @@ jobs:
             echo "  Example: feat: add Azure container deployment support"
             exit 1
           fi
-          # Self-hosted Renovate opens renovate/alien-<issue>-<slug> as the token user.
-          # The slug may contain dots, which the human branch pattern rejects.
           if [[ "$PR_AUTHOR" != "dependabot[bot]" && "$PR_AUTHOR" != "renovate[bot]" ]] &&
-             ! grep -qE '^renovate/alien-[0-9]+-[a-z0-9][a-z0-9._-]*$' <<< "$BRANCH" &&
              ! grep -qE '^[a-z0-9][a-z0-9._-]*/alien-[0-9]+-[a-z0-9]+(-[a-z0-9]+)*$' <<< "$BRANCH"; then
             echo "::error::Branch must include its Linear issue, for example: alon/alien-123-azure-containers"
             exit 1

.github/workflows/repair-renovate-lockfiles.yml

@@ -0,0 +1,54 @@
+name: Repair Renovate lockfiles
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths:
+      - "**/package.json"
+      - "**/pnpm-lock.yaml"
+      - "**/pnpm-workspace.yaml"
+
+concurrency:
+  group: repair-renovate-lockfiles-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  repair:
+    # Keep dependency automation paused until explicitly re-enabled.
+    if: ${{ false }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+
+      - name: Regenerate pnpm lockfiles
+        run: |
+          pnpm install --lockfile-only --no-frozen-lockfile --ignore-scripts
+          pnpm --dir examples install --lockfile-only --no-frozen-lockfile --ignore-scripts
+          pnpm --dir examples/github-agent/packages/dashboard install \
+            --lockfile-only --no-frozen-lockfile --ignore-scripts
+
+      - name: Commit repaired lockfiles
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          PUSH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
+        run: |
+          git add pnpm-lock.yaml examples/pnpm-lock.yaml \
+            examples/github-agent/packages/dashboard/pnpm-lock.yaml
+          if git diff --cached --quiet; then
+            exit 0
+          fi
+          git config user.name "alien-platform[bot]"
+          git config user.email "3108015+alien-platform[bot]@users.noreply.github.com"
+          git commit -m "chore(deps): repair pnpm lockfiles"
+          git push "https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            "HEAD:${BRANCH}"

renovate.json

@@ -1,4 +1,45 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "enabled": false
+  "enabled": false,
+  "extends": ["config:recommended"],
+  "additionalBranchPrefix": "alien-370-",
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/examples/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/tests/**",
+    "**/__fixtures__/**",
+    "docker/Dockerfile.alien-sandbox-agent",
+    "docker/Dockerfile.alien-sandbox-default",
+    "docker/Dockerfile.alien-sandbox-gcp"
+  ],
+  "packageRules": [
+    {
+      "description": "Automerge stable non-major updates independently after CI passes",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash"
+    },
+    {
+      "description": "Do not treat potentially breaking 0.x minor releases as routine updates",
+      "matchUpdateTypes": ["minor"],
+      "matchCurrentVersion": "/^0\\./",
+      "enabled": false
+    },
+    {
+      "description": "Require explicit dashboard approval for major updates",
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "ts-proto updates require regenerated Worker runtime clients",
+      "matchPackageNames": ["ts-proto"],
+      "automerge": false
+    }
+  ]
 }