DVR-97 add support to Renovate

[edro15]

👉 Please ensure your pull request (PR) adheres to our Contribution Guidelines 👈

Pull Request Checklist

Please check if your PR fulfills the following requirements:

• Testing of all the changes has been performed (for bug fixes / features)
• The docs/readme.md has been reviewed and updated if needed (for bug fixes / features)
• Provide release notes as part of the PR submission which describe high level points about the changes
• Verify all checks are passing
• Do NOT use the main branch of the forked repo. Create separate feature branch for raising the PR

Pull Request Type

Please check the type of change your PR introduces:

• Bugfix
• Feature
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no api changes)
• Documentation
• Other (please describe): added support to renovate by adding configuration files and automation pipeline

Security Considerations (REQUIRED)

• If you are adding an integration with 3rd party system
  • Please document in the docs/readme.md all methods (eg, OAuth) used to authenticate
    with the service that the add-on is integrating with

Release Notes (REQUIRED)

• Provide release notes as part of the PR submission which describe high level points about the changes for the upcoming release.

---

Thanks for contributing! ❤️

In general, the fix is to add an explicit permissions block that grants only the minimal required scopes to GITHUB_TOKEN. This can be done at the top level of the workflow (applies to all jobs) or per job. For this single-job workflow, either is fine; adding permissions at the root is simplest and keeps the job body unchanged.

Best minimal fix without altering existing functionality:

• Add a permissions block at the root level (same indentation as on: and jobs:) after concurrency: renovate (or before, as long as indentation is correct).
• Start from contents: read as the minimal baseline. Renovate usually needs to read repository contents and may also need to open or update pull requests. However, Renovate in this setup appears to use a GitHub App token (steps.get_token.outputs.token) for its write operations, so the GITHUB_TOKEN itself can safely be read-only unless the workflow uses it elsewhere (it does not in the shown snippet).
• Thus, define:

  permissions:
    contents: read

• No imports or additional methods are needed; this is a pure YAML configuration change.

This change should be placed in .github/workflows/renovate.yml after line 9 (concurrency: renovate) to keep the file structure clear and avoid altering job logic.