refactor: consume the shared renovate preset

renovate.json

@@ -1,94 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":semanticCommits",
-    ":semanticCommitTypeAll(deps)",
-    ":dependencyDashboard",
-    "schedule:weekly",
-    "group:allNonMajor"
-  ],
-  "timezone": "America/Los_Angeles",
-  "labels": ["deps"],
-  "prHourlyLimit": 4,
-  "prConcurrentLimit": 8,
-  "rebaseWhen": "behind-base-branch",
-  "semanticCommitScope": "deps",
-  "lockFileMaintenance": {
-    "enabled": true,
-    "schedule": ["before 6am on monday"]
-  },
-  "packageRules": [
-    {
-      "description": "Patch + minor open a PR and wait for a human. Renovate has never executed in this org, so nothing here has been observed doing what it claims; automerge stays off until a few cycles of real PRs have been reviewed. automergeType is 'pr' rather than 'branch' for when it is re-enabled: 'branch' commits straight to the base branch without ever opening a PR, which this org does not do.",
-      "matchUpdateTypes": ["patch", "minor"],
-      "automerge": false,
-      "automergeType": "pr"
-    },
-    {
-      "description": "Major upgrades always need review",
-      "matchUpdateTypes": ["major"],
-      "automerge": false,
-      "labels": ["deps", "major"]
-    },
-    {
-      "description": "Group @aws-sdk/* (npm) — they release together",
-      "matchManagers": ["npm"],
-      "groupName": "aws-sdk-js",
-      "matchPackageNames": ["/^@aws-sdk//", "/^@smithy//"]
-    },
-    {
-      "description": "Group typescript-eslint plugins",
-      "matchManagers": ["npm"],
-      "groupName": "eslint-stack",
-      "matchPackageNames": [
-        "/^@typescript-eslint//",
-        "/^typescript-eslint$/",
-        "/^@eslint//",
-        "/^eslint-plugin-/"
-      ]
-    },
-    {
-      "description": "Group vitest core + coverage",
-      "matchManagers": ["npm"],
-      "groupName": "vitest",
-      "matchPackageNames": ["/^vitest$/", "/^@vitest//"]
-    },
-    {
-      "description": "GitHub Actions — group minor + patch into one PR",
-      "matchManagers": ["github-actions"],
-      "groupName": "github-actions",
-      "schedule": ["before 6am on monday"]
-    },
-    {
-      "description": "Pin GitHub Actions to commit SHAs (supply-chain hardening)",
-      "matchManagers": ["github-actions"],
-      "pinDigests": true
-    },
-    {
-      "description": "Helm chart versions in gitops/applicationset-entry.yaml",
-      "matchManagers": ["argocd", "helm-values", "helmv3"],
-      "groupName": "helm-charts",
-      "schedule": ["before 6am on monday"]
-    },
-    {
-      "description": "Docker base image (Dockerfile)",
-      "matchManagers": ["dockerfile"],
-      "groupName": "docker-base",
-      "schedule": ["before 6am on monday"]
-    },
-    {
-      "description": "Security/CVE updates: ALWAYS human review. This rule is intentionally LAST in packageRules — Renovate evaluates rules in order with later rules winning, so without this entry the earlier 'auto-merge patch + minor' rule would silently auto-merge CVE-triggered patches. The vulnerabilityAlerts top-level block ALSO sets automerge: false, but per-package rules override top-level settings — hence the explicit packageRule here.",
-      "matchUpdateTypes": ["patch", "minor", "major"],
-      "isVulnerabilityAlert": true,
-      "automerge": false,
-      "labels": ["security", "deps", "needs-review"]
-    }
-  ],
-  "vulnerabilityAlerts": {
-    "labels": ["security", "deps"],
-    "automerge": false,
-    "schedule": ["at any time"]
-  },
-  "osvVulnerabilityAlerts": true
+  "extends": ["github>nanohype/.github"]
 }