Add Renovate or Dependabot for automated dependency updates

[haasonsaas]

Problem

No renovate.json or .dependabot.yml exists in any EvalOps repository. Dependencies drift silently. When a CVE drops for pgx, NATS, OPA, or any transitive dependency, the org will find out from a security incident rather than an automated PR.

Specific drift observed:

• cerebro still uses AWS SDK v1 (v2 has been stable for years)
• testify appears in every go.sum as a transitive dependency but is never imported
• 6 different Go versions across services (separate issue Standardize Go version to 1.26 across all services #40)

Proposal

Option A: Renovate (recommended)

Create a shared renovate.json template:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "go": {
    "rangeStrategy": "bump"
  },
  "schedule": ["before 9am on Monday"],
  "automerge": true,
  "automergeType": "pr",
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true
    },
    {
      "matchUpdateTypes": ["minor", "major"],
      "automerge": false
    }
  ]
}

Option B: Dependabot

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5

Rollout

Add to all Go service repos (14 total). Start with service-runtime since it's the dependency root.

Impact

• Automated vulnerability detection
• Keeps dependencies fresh with minimal manual effort
• Patches auto-merged, minor/major versions create PRs for review

[haasonsaas]

Partial progress — the most critical part (internal evalops/* dependency automation) is now covered:

• Proto auto-bump: semver tagging + fanout dispatch to 25 consumer repos. Event-driven, not polling.
• Dependabot: already present on most repos for external Go modules and GitHub Actions.
• service-runtime fanout: not yet implemented but the same pattern from proto can be replicated.

Remaining gap: a unified Renovate config for external dependencies across all repos (the CVE detection use case). Dependabot covers this partially but Renovate's grouped PRs and cross-repo strategies would be more ergonomic at 28 Go repos.

Leaving open for the external dependency automation piece.