FuTuRe/renovate.json at main · Ethereal-Future/FuTuRe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "security:openssf-scorecard"
  ],

  "description": "Renovate dependency update automation for FuTuRe (issue #773)",

  "schedule": ["every weekend"],

  "timezone": "UTC",

  "labels": ["dependencies"],

  "assignees": [],

  "reviewers": [],

  "prConcurrentLimit": 10,

  "prHourlyLimit": 4,

  "semanticCommits": "enabled",

  "commitMessagePrefix": "chore(deps):",

  "packageRules": [
    {
      "description": "Group all minor and patch npm updates into a single PR to reduce noise",
      "matchManagers": ["npm"],
      "matchUpdateTypes": ["minor", "patch"],
      "matchDepTypes": ["dependencies", "devDependencies"],
      "groupName": "npm minor and patch updates",
      "groupSlug": "npm-minor-patch",
      "labels": ["dependencies", "automerge-candidate"],
      "schedule": ["every weekend"]
    },
    {
      "description": "Security updates are separate high-priority PRs and run immediately",
      "matchManagers": ["npm"],
      "matchCategories": ["security"],
      "labels": ["dependencies", "security"],
      "schedule": ["at any time"],
      "prPriority": 10,
      "groupName": null
    },
    {
      "description": "Major version bumps are separate PRs requiring manual review",
      "matchManagers": ["npm"],
      "matchUpdateTypes": ["major"],
      "labels": ["dependencies", "breaking-change"],
      "groupName": null,
      "automerge": false
    },
    {
      "description": "GitHub Actions — keep pinned SHAs up to date",
      "matchManagers": ["github-actions"],
      "labels": ["dependencies", "ci"],
      "groupName": "GitHub Actions",
      "schedule": ["every weekend"]
    },
    {
      "description": "Backend npm packages",
      "matchManagers": ["npm"],
      "matchFileNames": ["backend/package.json"],
      "labels": ["dependencies", "backend"]
    },
    {
      "description": "Frontend npm packages",
      "matchManagers": ["npm"],
      "matchFileNames": ["frontend/package.json"],
      "labels": ["dependencies", "frontend"]
    },
    {
      "description": "Pin exact versions for Stellar SDK to avoid unexpected breaking changes",
      "matchManagers": ["npm"],
      "matchPackageNames": ["@stellar/stellar-sdk"],
      "rangeStrategy": "pin",
      "labels": ["dependencies", "stellar"]
    },
    {
      "description": "Prisma client and CLI must be kept in sync — update together",
      "matchManagers": ["npm"],
      "matchPackageNames": ["prisma", "@prisma/client", "@prisma/adapter-pg"],
      "groupName": "Prisma",
      "labels": ["dependencies", "prisma"]
    }
  ],

  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security", "dependencies"],
    "schedule": ["at any time"]
  },

  "osvVulnerabilityAlerts": true,

  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["on the first day of the month"],
    "labels": ["dependencies", "lock-file-maintenance"]
  },

  "ignoreDeps": [],

  "ignorePaths": [
    "e2e/package.json",
    "mobile-tests/package.json",
    "security/package.json",
    "stellar-contract/**"
  ]
}