From aee9df738c0fb192c9139938775c556e1a40ef9a Mon Sep 17 00:00:00 2001
From: Jake Fineman <jakefineman@gmail.com>
Date: Mon, 7 Sep 2026 20:17:30 -0400
Subject: [PATCH] chore(renovate): add default.json preset with GitHub Packages
 hostRules

Renovate has never resolved any @wave-av/* package in any repo. The org
preset sets an npmrc pointing @wave-av at npm.pkg.github.com but supplies
no credentials, and GitHub Packages requires auth even to READ - so every
lookup returns `no-result`, including in wave-foundation.

Two fixes, one file:

1. hostRules for https://npm.pkg.github.com/ with the token supplied as
   {{ secrets.WAVE_PACKAGES_READ_TOKEN }}. No secret is committed - the
   Mend-hosted app resolves that reference from an ORG-scoped secret set
   in Credentials at developer.mend.io. Mend no longer reads `encrypted`
   blobs from repo config, so this templating is the supported route.

2. The preset lives in default.json, not renovate.json. Renovate fetches
   default.json first and only falls back to renovate.json with the
   deprecation warning the fleet has been seeing. renovate.json is now
   just the .github repo own config extending the shared preset.

Also replaces the removed matchPackagePatterns key with matchPackageNames.
Renovate still auto-migrates the old key, so this is future-proofing, not
a bug fix.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 default.json  | 37 +++++++++++++++++++++++++++++++++++++
 renovate.json | 26 ++------------------------
 2 files changed, 39 insertions(+), 24 deletions(-)
 create mode 100644 default.json

diff --git a/default.json b/default.json
new file mode 100644
index 0000000..96d1fd5
--- /dev/null
+++ b/default.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "WAVE org-wide Renovate preset. Every wave-av repo extends this via `local>wave-av/.github`. Named default.json (NOT renovate.json) because Renovate resolves a preset to default.json first and only falls back to renovate.json with a deprecation warning.",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "npmrc": "@wave-av:registry=https://npm.pkg.github.com/",
+  "hostRules": [
+    {
+      "description": "Read credentials for GitHub Packages. Without this, every @wave-av/* lookup fails with `no-result` because npm.pkg.github.com requires auth even to READ. The token is NOT stored here: `{{ secrets.* }}` is resolved by the Mend-hosted app from an ORG-scoped secret set in the Credentials section of the wave-av org settings at developer.mend.io. Nothing secret is committed.",
+      "matchHost": "https://npm.pkg.github.com/",
+      "hostType": "npm",
+      "token": "{{ secrets.WAVE_PACKAGES_READ_TOKEN }}"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates - which then triggers each spoke's deploy-on-merge.",
+      "matchPackageNames": [
+        "@wave-av/**"
+      ],
+      "rangeStrategy": "bump",
+      "semanticCommitType": "chore",
+      "commitMessageTopic": "spoke-chassis",
+      "labels": [
+        "chassis-automerge"
+      ],
+      "minimumReleaseAge": "0 days"
+    }
+  ],
+  "schedule": [
+    "after 1am and before 6am"
+  ],
+  "timezone": "America/New_York"
+}
diff --git a/renovate.json b/renovate.json
index dcb3f81..b11009a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,28 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended",
-    ":dependencyDashboard",
-    "helpers:pinGitHubActionDigests"
-  ],
-  "npmrc": "@wave-av:registry=https://npm.pkg.github.com",
-  "packageRules": [
-    {
-      "description": "WAVE internal packages (the spoke-chassis): keep every spoke on the LATEST published version. Labeled chassis-automerge so the renovate-reaper (wave-foundation) auto-approves + squash-merges these after its diff/lockfile/deploy gates — which then triggers each spoke's deploy-on-merge.",
-      "matchPackagePatterns": [
-        "^@wave-av/"
-      ],
-      "rangeStrategy": "bump",
-      "semanticCommitType": "chore",
-      "commitMessageTopic": "spoke-chassis",
-      "labels": [
-        "chassis-automerge"
-      ],
-      "minimumReleaseAge": "0 days"
-    }
-  ],
-  "schedule": [
-    "after 1am and before 6am"
-  ],
-  "timezone": "America/New_York"
+    "local>wave-av/.github"
+  ]
 }