Use Github Action instead of renovate to update lockfile

.github/workflows/pr.yml

@@ -1,6 +1,7 @@
 name: Pull Request
 
 on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
   pull_request:
 
 # This workflow should cancel previous builds since it means that a new commit has been made to the PR

.github/workflows/renovate-lockfiles.yml

@@ -0,0 +1,63 @@
+name: Auto-update Renovate lockfiles
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - "renovate/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  update-lockfiles:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # To push to the current branch
+    steps:
+      # Avoid re-running when this workflow just pushed a lockfile update
+      - name: Check if lockfiles were just updated
+        id: check-skip
+        env:
+          COMMIT_AUTHOR: ${{ github.event.head_commit.author.email }}
+        run: |
+          if [[ "$COMMIT_AUTHOR" == "github-actions[bot]@users.noreply.github.com" ]]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.check-skip.outputs.skip != 'true'
+
+      - uses: ./.github/actions/setup-build-env
+        if: steps.check-skip.outputs.skip != 'true'
+        with:
+          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          mock-google-services: "true"
+
+      - name: Update lockfiles
+        if: steps.check-skip.outputs.skip != 'true'
+        run: ./gradlew alldependencies --write-locks
+
+      - name: Commit and push updated lockfiles
+        if: steps.check-skip.outputs.skip != 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add '*.lockfile'
+          if git diff --staged --quiet; then
+            echo "Lockfiles are already up to date"
+          else
+            git commit -m "Update dependency lockfiles"
+            git push
+          fi
+
+      - name: Trigger Workflow
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        if: steps.check-skip.outputs.skip != 'true'
+        with:
+          script: |
+            github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'pr.yml',
+              ref: context.ref,
+            })

renovate.json5

@@ -2,14 +2,16 @@
     $schema: 'https://docs.renovatebot.com/renovate-schema.json',
     configMigration: true,
     extends: [
-        'config:recommended',
+        'config:best-practices',
         'group:linters',
         'group:monorepos',
         'group:recommended',
     ],
-    lockFileMaintenance: {
-        enabled: true,
-    },
+    // Lockfile updates are handled by the renovate-lockfiles CI workflow because
+    // Renovate's environment lacks the Android NDK/CMake required by :microfrontend.
+    updateLockFiles: false,
+    // Allow Renovate to continue managing PRs after the CI bot commits lockfile updates.
+    gitIgnoredAuthors: ['github-actions[bot]@users.noreply.github.com'],
     minimumReleaseAge: '3 days',
     hostRules: [
         {