From c9afec2041ef504867061aaa9c157f9db066266b Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Fri, 7 Aug 2026 17:47:58 -0700 Subject: [PATCH 1/2] refactor: consume the shared renovate preset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo carried a full copy of the org's Renovate posture. It now extends the shared preset at nanohype/.github instead, so a posture change is one edit rather than the same edit in six places — which is how these copies drifted apart in the first place. No behaviour change is intended. Everything removed here is byte-identical to what the preset now carries, or narrower than it: the grouping rules match by manager rather than by path, so their bodies were already the same across repos even where the descriptions differed. Worth knowing for the next person: renovate-config-validator does NOT resolve remote presets. Pointing extends at a repo that does not exist still validates "successfully", so a clean validation proves the JSON is well-formed and the local keys are valid — not that the preset reference resolves. The check that proves that is Renovate's next run still producing a Dependency Dashboard with the same grouped updates. --- renovate.json | 104 +------------------------------------------------- 1 file changed, 2 insertions(+), 102 deletions(-) diff --git a/renovate.json b/renovate.json index eece165..aee0f9b 100644 --- a/renovate.json +++ b/renovate.json @@ -1,106 +1,6 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ - "config:recommended", - ":semanticCommits", - ":semanticCommitTypeAll(deps)", - ":dependencyDashboard", - "schedule:weekly", - "group:allNonMajor" - ], - "timezone": "America/Los_Angeles", - "labels": ["deps"], - "prHourlyLimit": 4, - "prConcurrentLimit": 8, - "rebaseWhen": "behind-base-branch", - "semanticCommitScope": "deps", - "lockFileMaintenance": { - "enabled": true, - "schedule": ["before 6am on monday"] - }, - "packageRules": [ - { - "description": "Patch + minor open a PR and wait for a human. Renovate has never executed in this org, so nothing here has been observed doing what it claims; automerge stays off until a few cycles of real PRs have been reviewed. automergeType is 'pr' rather than 'branch' for when it is re-enabled: 'branch' commits straight to the base branch without ever opening a PR, which this org does not do.", - "matchUpdateTypes": ["patch", "minor"], - "automerge": false, - "automergeType": "pr" - }, - { - "description": "Major upgrades always need review", - "matchUpdateTypes": ["major"], - "automerge": false, - "labels": ["deps", "major"] - }, - { - "description": "Group @aws-sdk/* (npm) — they release together", - "matchManagers": ["npm"], - "groupName": "aws-sdk-js", - "matchPackageNames": ["/^@aws-sdk//", "/^@smithy//"] - }, - { - "description": "Group @opentelemetry/* — the SDK + exporters + instrumentations move together", - "matchManagers": ["npm"], - "groupName": "opentelemetry", - "matchPackageNames": ["/^@opentelemetry//"] - }, - { - "description": "Group the Postgres client + its types", - "matchManagers": ["npm"], - "matchPackageNames": ["pg", "@types/pg"], - "groupName": "pg" - }, - { - "description": "Group typescript-eslint plugins", - "matchManagers": ["npm"], - "groupName": "eslint-stack", - "matchPackageNames": [ - "/^@typescript-eslint//", - "/^typescript-eslint$/", - "/^@eslint//", - "/^eslint-plugin-/" - ] - }, - { - "description": "Group vitest core + coverage", - "matchManagers": ["npm"], - "groupName": "vitest", - "matchPackageNames": ["/^vitest$/", "/^@vitest//"] - }, - { - "description": "GitHub Actions — group minor + patch into one PR", - "matchManagers": ["github-actions"], - "groupName": "github-actions", - "schedule": ["before 6am on monday"] - }, - { - "description": "Pin GitHub Actions to commit SHAs (supply-chain hardening)", - "matchManagers": ["github-actions"], - "pinDigests": true - }, - { - "description": "Helm chart versions in gitops/applicationset-entry.yaml", - "matchManagers": ["argocd", "helm-values", "helmv3"], - "groupName": "helm-charts", - "schedule": ["before 6am on monday"] - }, - { - "description": "Docker base image (Dockerfile)", - "matchManagers": ["dockerfile"], - "groupName": "docker-base", - "schedule": ["before 6am on monday"] - }, - { - "description": "Security/CVE updates: ALWAYS human review. This rule is intentionally LAST in packageRules — Renovate evaluates rules in order with later rules winning, so without this entry the earlier 'auto-merge patch + minor' rule would silently auto-merge CVE-triggered patches. The vulnerabilityAlerts top-level block ALSO sets automerge: false, but per-package rules override top-level settings — hence the explicit packageRule here.", - "matchUpdateTypes": ["patch", "minor", "major"], - "isVulnerabilityAlert": true, - "automerge": false, - "labels": ["security", "deps", "needs-review"] - } - ], - "vulnerabilityAlerts": { - "labels": ["security", "deps"], - "automerge": false, - "schedule": ["at any time"] - }, - "osvVulnerabilityAlerts": true + "github>nanohype/.github" + ] } From 14e4646196002d8a2d9ed159b9217192c9c9bd89 Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Fri, 7 Aug 2026 17:53:50 -0700 Subject: [PATCH 2/2] style: format renovate.json with biome Formatting only; no config change. --- renovate.json | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/renovate.json b/renovate.json index aee0f9b..01564bd 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,4 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "github>nanohype/.github" - ] + "extends": ["github>nanohype/.github"] }