[MaxMichel2]

Summary

• Regenerate and check Metalava API signatures on Renovate pushes, then commit only changed API files.
• Use a PAT-backed push so Build CI runs again; skip fixup pushes and limit manual dispatch to Renovate branches.
• Ignore the fixup author's commits in Renovate and include KSP in the existing Kotlin group; allow the Kotlin 2.4 / Mokkery 3.5 / Poko 0.23 ecosystem verified on ⬆️ Update dependency org.jetbrains.kotlin:kotlin-gradle-plugin to v2.4.20 [SECURITY] #137.
• Declare Metalava's dependency on non-test KSP generation (the actual failure in ⬆️ Update all dependencies #71).

Why not postUpgradeTasks?

This repository uses Mend-hosted Renovate, which restricts post-upgrade commands through a hosted allowlist and does not provide the Android SDK needed for this build. This workflow is a post-push fixup, not pre-push generation; true pre-push execution would require a suitable self-hosted Renovate runner.

Validation

• Renovate config validator and actionlint passed.
• Local Metalava generation/check passed on ⬆️ Update all dependencies #71 and ⬆️ Update dependency org.jetbrains.kotlin:kotlin-gradle-plugin to v2.4.20 [SECURITY] #137; ⬆️ Update dependency org.jetbrains.kotlin:kotlin-gradle-plugin to v2.4.20 [SECURITY] #137 unit/host tests, sample debug build and detektFull passed.
• Pre-commit gitleaks and Detekt passed.
• No docs update needed: shared build wiring/CI only, no source public API change. No CHANGELOG entry.

Required before enabling

Create repository secret RENOVATE_FIXUP_TOKEN: fine-grained PAT for worldline/devview with Contents: write. It must belong to an actor other than renovate[bot]. GITHUB_TOKEN cannot substitute because its pushes do not trigger subsequent workflows. An App token needs explicit issuance (e.g. actions/create-github-app-token) if chosen instead.

Merge this PR, update/rebase the Renovate branches so they contain the workflow, then dispatch on a renovate/* branch and confirm an API fixup commit and a new Build run. No automatic merge performed here.

Kotlin grouping is preventive, not a compatibility solver: Renovate security PRs may remain isolated, so companion compiler-plugin versions still need review.

[MaxMichel2]

Closing after discussion: we will not introduce a credential-backed workflow that automatically rewrites library API signatures. Dependency/compiler compatibility and API drift should remain explicitly reviewed. Renovate version-range policy will be reconsidered separately.