feat: add Renovate CLI with GitHub Actions workflow

.github/renovate.json5

@@ -0,0 +1,38 @@
+// .github/renovate.json5
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
+    "config:recommended",
+    ":semanticCommits",
+    ":separateMajorReleases",
+    ":disableDependencyDashboard",
+  ],
+  timezone: "Asia/Tokyo",
+  automerge: false,
+  platformAutomerge: false,
+  labels: ["dependencies", "renovate"],
+  prCreation: "immediate",
+  rangeStrategy: "replace",
+  rebaseWhen: "behind-base-branch",
+  packageRules: [
+    {
+      matchManagers: ["gomod"],
+      groupName: "Go modules",
+      groupSlug: "gomod-all",
+      separateMultipleMajor: false,
+      postUpdateOptions: ["gomodTidy"],
+    },
+    {
+      matchManagers: ["dockerfile"],
+      groupName: "Docker base images",
+      groupSlug: "docker-all",
+      separateMultipleMajor: false,
+    },
+    {
+      matchManagers: ["github-actions"],
+      groupName: "GitHub Actions",
+      groupSlug: "gha-all",
+      separateMultipleMajor: false,
+    },
+  ],
+}

.github/workflows/renovate.yml

@@ -0,0 +1,30 @@
+# .github/workflows/renovate.yml
+name: Renovate (CLI)
+
+on:
+  schedule:
+    # JST 06:00 土曜 = UTC 金曜 21:00
+    - cron: "0 21 * * 5"
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Renovate
+        uses: renovatebot/github-action@v40.1.12
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+          configurationFile: .github/renovate.json5
+        env:
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_PLATFORM: github
+          LOG_LEVEL: info