Add renovate workflow

.github/workflows/renovate.yaml

@@ -0,0 +1,15 @@
+name: Renovate
+on:
+  schedule:
+    - cron: '0 0 * * 2'
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@2a87d1192eaa0cac92b6566233afedf68fd3472a # renovate v38.1.8
+        with:
+          configurationFile: renovate.json
+          token: ${{ secrets.RENOVATE_TOKEN }}

docs/maintenance.md

@@ -12,4 +12,5 @@ If Kubernetes or controller-runtime API has changed, please fix the relevant sou
 
 ## How to update dependencies
 
-TBD.
+Renovate will create PRs that update dependencies once a week.
+However, Kubernetes is only updated with patched versions.

renovate.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "username": "renovate[bot]",
+  "gitAuthor": "Renovate Bot <bot@renovateapp.com>",
+  "platform": "github",
+  "onboarding": false,
+  "repositories": [
+    "cybozu-go/pod-security-admission"
+  ],
+  "extends": [
+    "config:base",
+    "github>aquaproj/aqua-renovate-config#1.6.0",
+    ":semanticCommitTypeAll(chore)",
+    ":timezone(Asia/Tokyo)"
+  ],
+  "ignorePresets": [":prHourlyLimit2"],
+  "labels": [
+    "dependencies"
+  ],
+  "packageRules": [
+    {
+      "description": "Separate minor and patch updates for Kubernetes packages",
+      "matchDatasources": [
+        "go"
+      ],
+      "matchPackagePatterns": [
+        "^k8s\\.io\\/.*"
+      ],
+      "separateMinorPatch": true
+    },
+    {
+      "description": "Disable major updates for k8s.io/client-go",
+      "enabled": false,
+      "matchDatasources": [
+        "go"
+      ],
+      "matchPackageNames": [
+        "k8s.io/client-go"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ]
+    }
+  ],
+  "postUpdateOptions": [
+    "gomodTidy"
+  ]
+}