Establish dependency management governance

[MioYuuIH]

Summary

Set up a repeatable dependency management workflow for AUP Learning Cloud so dependency updates are visible, reviewable, and safe to apply across the repository.

A baseline implementation branch exists:

• chore/dependency-governance-renovate

That branch introduces a self-hosted Renovate workflow and configuration for managing dependency updates across package manifests, GitHub Actions, Dockerfiles, selected bare version pins, and chart/image references.

Direction

The goal is not to automatically merge dependency updates. The goal is to create a controlled update queue with clear review boundaries.

Initial direction:

• Run Renovate as a self-hosted workflow.
• Target dependency update PRs at develop.
• Keep automerge disabled.
• Use weekly update cadence.
• Use dashboard/manual approval for high-risk stacks.
• Track selected bare version pins with Renovate custom regex managers.
• Keep ROCm/PyTorch updates manual until compatibility is reviewed separately.
• Do not propose Ubuntu base image major upgrades automatically.
• Prefer short-lived bot/App credentials over long-lived personal tokens for production automation.

Follow-up Work

• Decide the production authentication model for the Renovate workflow.
• Decide whether Renovate should manage GitHub Actions workflow dependencies.
• Open a PR for the dependency governance baseline branch.
• Add a reporting-only security scan plan for manifests and images.
• Define a Python dependency pinning or constraints strategy.
• Review the first Renovate dashboard output and tune grouping/noise.

Acceptance Criteria

• Dependency update automation can run without automerge.
• Updates are grouped and rate-limited enough to be reviewable.
• High-risk runtime stacks require manual validation.
• The repository has an agreed production token/authentication model for dependency automation.
• Maintainers can see what dependencies are outdated and choose which PRs to create.