feat: shared Renovate automerge preset and self-hosted CI

.github/actionlint.yaml

@@ -0,0 +1,2 @@
+self-hosted-runner:
+  labels: [hetzner]

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+---
+name: CI
+
+"on":
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    # Fork PRs never run on the self-hosted runner.
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, Linux, X64, hetzner]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        env:
+          SKIP: no-commit-to-branch

renovate-automerge.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Shared bot-PR automerge policy for bakerboy448/* and baker-scripts/*: patch and minor updates automerge once CI passes, after a 3-day release-age hold. Public repos use GitHub auto-merge gated on required status checks. Private repos on GitHub Free set platformAutomerge to false, so Renovate merges only when every status check on the branch is green and never when a branch has zero checks. Rules in a repo's own config come after this preset and win.",
+  "platformAutomerge": true,
+  "ignoreTests": false,
+  "packageRules": [
+    {
+      "description": "Patch and minor updates: automerge when CI is green, held 3 days so a bad release surfaces first",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "minimumReleaseAge": "3 days",
+      "automerge": true
+    }
+  ]
+}

renovate.json

@@ -3,6 +3,7 @@
   "description": "Inlined house Renovate config — self-contained, public presets only.",
   "extends": [
     "config:best-practices",
+    "github>baker-scripts/.github:renovate-automerge",
     ":dependencyDashboard",
     ":semanticCommits",
     ":enableVulnerabilityAlertsWithLabel(security)"
@@ -21,7 +22,6 @@
   "separateMajorMinor": true,
   "separateMinorPatch": false,
   "automerge": false,
-  "platformAutomerge": false,
   "rebaseWhen": "conflicted",
   "branchPrefix": "renovate/",
   "ignoreDeps": [],