chore: one dependency bot, not two

CLAUDE.md

@@ -108,7 +108,7 @@ documents: `task validate` runs it report-only, CI runs it `--blocking`.
 - PR and push to main trigger `.github/workflows/ci.yml` (lint → validate per environment → PR summary)
 - The validate job renders every kustomize root plus the druid catalog chart, then gates the rendered output: render-assert (no unfilled sentinels), kubeconform strict (native schemas + datreeio CRDs-catalog, no ignore-missing-schemas, via the shared `scripts/kubeconform-scan.sh`), and `trivy config` (misconfiguration scan, MEDIUM+ hard-fails; scoped justified exceptions live in `.trivyignore.yaml`)
 - Standalone jobs on every PR: `helm-render` (templates every addon against its appset-pinned chart with base + each env's values — an unknown key fails here, not fleet-wide at sync), `policy-admission` (renders the whole fleet into its real destination namespaces and runs `kyverno apply` against the Enforce-tier best-practice/pod-security policies, so an addon landing in a namespace the policies don't exclude fails here instead of being denied at admission on a vended enforce cluster — also asserts all four exclusion lists stay identical, that every namespace the fleet lands a workload in is on that list, and that a deliberately non-compliant canary is denied by every rule, which is what proves the run evaluated anything), `appsets` (ApplicationSet schema + documented sync-wave ordering), `appset-render` (renders the Karpenter EC2NodeClass patch template the way the ArgoCD ApplicationSet controller does — Go text/template + sprig, `missingkey=error` — against fixture create/adopt/legacy cluster Secrets, so a control-flow edit that breaks the per-cluster render fails here instead of at sync), `secrets` (gitleaks over the working tree), plus the dashboard, fork-safety, and Kyverno policy gates
-- Chart pins in `applicationsets/` are watched by Renovate (`renovate.json`); `.github/dependabot.yml` owns the github-actions bumps
+- Chart pins in `applicationsets/`, the Go module, the CI tool downloads and the GitHub Actions are all watched by Renovate (`renovate.json`, extending the org preset at `nanohype/.github`)
 - Manual diff rendering available via `.github/workflows/diff.yml`
 
 ## Claude Code Tooling

renovate.json

@@ -1,16 +1,31 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "description": "Currency management for the catalog. Renovate watches every Helm chart version pinned in applicationsets/ (and the git-pinned Gateway API CRDs), the Go module behind the appset-render gate, and the CLI tools the CI workflow downloads — the helm-render + schema + policy CI gates then validate each bump before merge. Scoped to chart, git-tag, gomod, and CI-tool managers so it never overlaps the github-actions updates dependabot owns.",
-  "enabledManagers": ["argocd", "gomod", "custom.regex"],
+  "extends": [
+    "github>nanohype/.github"
+  ],
+  "description": [
+    "Currency management for the catalog, layered on the org preset at nanohype/.github.",
+    "What stays local is the manager scoping and the custom managers. Renovate watches every Helm chart version pinned in applicationsets/ (and the git-pinned Gateway API CRDs), the Go module behind the appset-render gate, the CLI tools the CI workflow downloads, and the GitHub Actions in .github/workflows/ — the helm-render, schema and policy CI gates then validate each bump before merge.",
+    "enabledManagers is an allowlist rather than a default because this repo is a manifest catalog: without it Renovate would try to read every values.yaml as a Helm chart it owns."
+  ],
+  "enabledManagers": [
+    "argocd",
+    "gomod",
+    "custom.regex",
+    "github-actions"
+  ],
   "argocd": {
-    "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"]
+    "managerFilePatterns": [
+      "/^applicationsets/[^/]+\\.ya?ml$/"
+    ]
   },
   "customManagers": [
     {
       "customType": "regex",
       "description": "HTTPS Helm chart pins in ApplicationSet matrix list elements (chartRepo/chart/chartVersion), which the argocd manager cannot resolve because they are templated onto the source.",
-      "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"],
+      "managerFilePatterns": [
+        "/^applicationsets/[^/]+\\.ya?ml$/"
+      ],
       "matchStrings": [
         "chartRepo:\\s*(?<registryUrl>https://[^\\s]+)\\s*\\n\\s*chart:\\s*(?<depName>[^\\s]+)\\s*\\n\\s*chartVersion:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
       ],
@@ -19,7 +34,9 @@
     {
       "customType": "regex",
       "description": "OCI Helm chart pins in ApplicationSet matrix list elements. The registry path carries the chart name for every pin, so packageName is the path alone.",
-      "managerFilePatterns": ["/^applicationsets/[^/]+\\.ya?ml$/"],
+      "managerFilePatterns": [
+        "/^applicationsets/[^/]+\\.ya?ml$/"
+      ],
       "matchStrings": [
         "chartRepo:\\s*oci://(?<packageName>[^\\s]+)\\s*\\n\\s*chart:[^\\n]*\\n\\s*chartVersion:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
       ],
@@ -28,7 +45,9 @@
     {
       "customType": "regex",
       "description": "Git-pinned Gateway API CRDs (gateway-api-crds.yaml). A plain manifest directory (config/crd/standard) sourced from a git tag, not a Helm chart, so neither the argocd manager nor the chart regex managers above can resolve it. Watched against the upstream GitHub release tags so a currency PR opens and runs the render + schema gates; the deliberate-bump rationale in the file still governs the merge decision.",
-      "managerFilePatterns": ["/^applicationsets/gateway-api-crds\\.ya?ml$/"],
+      "managerFilePatterns": [
+        "/^applicationsets/gateway-api-crds\\.ya?ml$/"
+      ],
       "matchStrings": [
         "repoURL:\\s*https://github\\.com/(?<depName>kubernetes-sigs/gateway-api)\\s*\\n\\s*targetRevision:\\s*(?<currentValue>v[0-9][^\\s]+)"
       ],
@@ -37,7 +56,9 @@
     {
       "customType": "regex",
       "description": "CLI tools the CI workflow downloads as release tarballs or installs through a setup action (kyverno/gitleaks/kubeconform/trivy). These are release binaries, not GitHub Actions (dependabot owns those), so they age silently otherwise. Each pin in ci.yml's top-level env block carries a `# renovate:` comment naming its datasource + GitHub repo; a bump also fails the hardcoded checksum next to it until a human confirms the new SHA256, so it never auto-merges blind.",
-      "managerFilePatterns": ["/^\\.github/workflows/ci\\.ya?ml$/"],
+      "managerFilePatterns": [
+        "/^\\.github/workflows/ci\\.ya?ml$/"
+      ],
       "matchStrings": [
         "#\\s*renovate:\\s*datasource=(?<datasource>[a-z-]+)\\s+depName=(?<depName>[^\\s]+)\\s*\\n\\s*[A-Z0-9_]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
       ],
@@ -46,27 +67,50 @@
   ],
   "packageRules": [
     {
-      "matchDatasources": ["helm", "docker"],
-      "labels": ["dependencies", "charts"]
+      "matchDatasources": [
+        "helm",
+        "docker"
+      ],
+      "labels": [
+        "dependencies",
+        "charts"
+      ]
     },
     {
-      "matchDatasources": ["github-releases"],
-      "matchPackageNames": ["kubernetes-sigs/gateway-api"],
-      "labels": ["dependencies", "charts"]
+      "matchDatasources": [
+        "github-releases"
+      ],
+      "matchPackageNames": [
+        "kubernetes-sigs/gateway-api"
+      ],
+      "labels": [
+        "dependencies",
+        "charts"
+      ]
     },
     {
-      "matchManagers": ["gomod"],
-      "labels": ["dependencies", "go"]
+      "matchManagers": [
+        "gomod"
+      ],
+      "labels": [
+        "dependencies",
+        "go"
+      ]
     },
     {
-      "matchDatasources": ["github-releases"],
+      "matchDatasources": [
+        "github-releases"
+      ],
       "matchPackageNames": [
         "kyverno/kyverno",
         "gitleaks/gitleaks",
         "yannh/kubeconform",
         "aquasecurity/trivy"
       ],
-      "labels": ["dependencies", "ci"]
+      "labels": [
+        "dependencies",
+        "ci"
+      ]
     }
   ]
 }