default.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "description": [
    "Shared Renovate posture for every nanohype repo. Consume it with a one-line renovate.json: {\"extends\": [\"github>nanohype/.github\"]}.",
    "This exists because the posture was previously copy-pasted into six repos and had already drifted: five carried automerge rules and eks-gitops carried none, and one copy needed a config migration the others did not. A tooling preset belongs in one consumed place, not in per-repo copies.",
    "ORDERING HAZARD, read before adding a repo-local packageRule: a consumer's packageRules are appended AFTER the ones here, and later rules win. The security rule at the end of this array is what keeps CVE-triggered updates out of automerge, so a local rule that sets automerge:true would land after it and defeat it. Any local rule enabling automerge must re-exclude isVulnerabilityAlert itself.",
    "TITLE CONTRACT: 'deps' is the semantic SCOPE, never the semantic TYPE. Renovate's PR title is the first thing a conventional-commit gate reads, and a type outside that gate's allowed list makes every PR this preset opens unmergeable in that repo — with no signal anywhere else, because a repo without such a gate merges the same title happily. Keep the type inside the conventional set (chore); express what is being updated in the scope.",
    "AGE FLOOR: minimumReleaseAge holds routine updates for three days. Partly that is supply-chain posture — a compromised publish is typically caught and unpublished within hours, and no dependency here is urgent enough to be worth being the first consumer of. Mostly it is so this preset stops proposing work the package managers will refuse. pnpm 11 defaults minimumReleaseAge to 1440 minutes AND re-verifies every entry in the lockfile on every install, not just the ones being added, so a single too-young package anywhere in the tree fails `pnpm install --frozen-lockfile` in repos that never touched it. Renovate's floor has to stay at or above the package manager's, or Renovate writes lockfiles that its own CI rejects. Three days leaves headroom over pnpm's one, and costs nothing against the weekly schedule already in force.",
    "The security path opts out on purpose: vulnerabilityAlerts sets minimumReleaseAge to null so a CVE fix is proposed the moment it exists. When the fix itself is hours old that can still produce a PR pnpm declines to install until it ages out. Opening it immediately is the point — the PR is the signal a human needs — and it goes green on a re-run without any config change."
  ],
  "extends": [
    "config:recommended",
    ":semanticCommits",
    ":semanticCommitTypeAll(chore)",
    ":dependencyDashboard",
    "schedule:weekly",
    "group:allNonMajor"
  ],
  "timezone": "America/Los_Angeles",
  "minimumReleaseAge": "3 days",
  "labels": ["deps"],
  "prHourlyLimit": 4,
  "prConcurrentLimit": 8,
  "rebaseWhen": "behind-base-branch",
  "semanticCommitScope": "deps",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on monday"]
  },
  "packageRules": [
    {
      "description": "Patch + minor open a PR and wait for a human. automergeType is 'pr' rather than 'branch' for whenever automerge is switched on: 'branch' commits straight to the base branch without ever opening a PR, which this org does not do.",
      "matchUpdateTypes": ["patch", "minor"],
      "automerge": false,
      "automergeType": "pr"
    },
    {
      "description": "Major upgrades always need review",
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "labels": ["deps", "major"]
    },
    {
      "description": "Group AWS SDK v2 (go) — they release together",
      "matchManagers": ["gomod"],
      "groupName": "aws-sdk-go-v2",
      "matchPackageNames": ["/^github.com/aws/aws-sdk-go-v2/"]
    },
    {
      "description": "Group @aws-sdk/* with @smithy/* (npm) — the SDK and the runtime it is generated against release together, and splitting them produces PRs that cannot pass CI alone.",
      "matchManagers": ["npm"],
      "groupName": "aws-sdk-js",
      "matchPackageNames": ["/^@aws-sdk//", "/^@smithy//"]
    },
    {
      "description": "Group k8s.io/* — they must move together",
      "matchManagers": ["gomod"],
      "groupName": "k8s-io",
      "matchPackageNames": ["/^k8s.io//"]
    },
    {
      "description": "Group sigs.k8s.io/* — controller-runtime + tooling",
      "matchManagers": ["gomod"],
      "groupName": "sigs-k8s",
      "matchPackageNames": ["/^sigs.k8s.io//"]
    },
    {
      "description": "Group @opentelemetry/* — the SDK, exporters and instrumentations move together",
      "matchManagers": ["npm"],
      "groupName": "opentelemetry",
      "matchPackageNames": ["/^@opentelemetry//"]
    },
    {
      "description": "Group the Postgres client with its types",
      "matchManagers": ["npm"],
      "matchPackageNames": ["pg", "@types/pg"],
      "groupName": "pg"
    },
    {
      "description": "Group the whole eslint stack — @eslint/* core packages, typescript-eslint, plugins and shared configs. A flat-config eslint upgrade that moves @eslint/js without its plugins fails lint on its own, so they travel together.",
      "matchManagers": ["npm"],
      "groupName": "eslint-stack",
      "matchPackageNames": [
        "/^@typescript-eslint//",
        "/^typescript-eslint$/",
        "/^@eslint//",
        "/^eslint-plugin-/",
        "/^eslint-config-/"
      ]
    },
    {
      "description": "Group vitest core + coverage",
      "matchManagers": ["npm"],
      "groupName": "vitest",
      "matchPackageNames": ["/^vitest$/", "/^@vitest//"]
    },
    {
      "description": "GitHub Actions — group minor + patch into one PR",
      "matchManagers": ["github-actions"],
      "groupName": "github-actions",
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "Pin GitHub Actions to commit SHAs (supply-chain hardening)",
      "matchManagers": ["github-actions"],
      "pinDigests": true
    },
    {
      "description": "Helm chart versions",
      "matchManagers": ["argocd", "helm-values", "helmv3"],
      "groupName": "helm-charts",
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "Docker base images",
      "matchManagers": ["dockerfile"],
      "groupName": "docker-base",
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "OpenTofu provider versions",
      "matchManagers": ["terraform"],
      "groupName": "terraform-providers",
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "Security/CVE updates: ALWAYS human review. Intentionally LAST — Renovate evaluates packageRules in order with later rules winning, so this must sit after any rule that could enable automerge. The vulnerabilityAlerts block below ALSO sets automerge false, but per-package rules override top-level settings, which is why this explicit rule exists as well.",
      "matchUpdateTypes": ["patch", "minor", "major"],
      "isVulnerabilityAlert": true,
      "automerge": false,
      "labels": ["security", "deps", "needs-review"]
    }
  ],
  "vulnerabilityAlerts": {
    "description": "minimumReleaseAge is null here on purpose, stated rather than inherited: the top-level three-day floor must not delay a CVE fix. Renovate already defaults this block that way, and writing it down keeps a future edit to the top-level floor from silently acquiring a delay on the security path.",
    "labels": ["security", "deps"],
    "automerge": false,
    "minimumReleaseAge": null,
    "schedule": ["at any time"]
  },
  "osvVulnerabilityAlerts": true
}