chore(renovate): group by scenario, weekly cadence with 3-day delay

Replaces per-manager grouping (npm-dev/npm-prod/composer/pip/upstream-*)
with per-scenario grouping: one PR per scenario covering its npm, docker,
composer, pip, and pinned image deps. Root npm collapses into a single
npm-web PR. github-actions stays as one weekly PR.

All groups inherit a Monday 09:00 schedule and 3-day minimumReleaseAge;
security alerts override both with "at any time" + no release-age gate.

Author: chrisns

renovate.json

@@ -15,6 +15,8 @@
     "minimumReleaseAge": null
   },
   "rangeStrategy": "bump",
+  "minimumReleaseAge": "3 days",
+  "schedule": ["before 09:00 on monday"],
   "configMigration": true,
   "ignorePaths": [
     "**/node_modules/**",
@@ -44,66 +46,93 @@
       "pinDigests": true
     },
     {
-      "description": "Own GHCR images — one PR per scenario; immediate when an image bumps. Smoke runs scoped to that scenario give fast feedback.",
-      "groupName": "scenario-{{packageName}}",
-      "matchManagers": ["custom.regex"],
-      "schedule": ["at any time"],
+      "description": "Pin official actions/* and aws-actions/* references in workflows to digest. Other action sources keep their existing pin shape.",
+      "matchManagers": ["github-actions"],
+      "pinDigests": true,
       "matchPackageNames": [
-        "/^ghcr\\.io/co-cddo/ndx_try_aws_scenarios-/"
+        "/^actions//",
+        "/^aws-actions//"
       ]
     },
     {
-      "description": "Upstream container deps (tika, paperless-ngx, gotenberg). Weekly grouped per image to keep blast radius small.",
-      "groupName": "upstream-{{packageName}}",
-      "matchManagers": ["custom.regex"],
-      "schedule": ["before 09:00 on monday"],
-      "matchPackageNames": [
-        "/^docker\\.io/apache/tika/",
-        "/^docker\\.io/gotenberg/gotenberg/",
-        "/^ghcr\\.io/paperless-ngx/paperless-ngx/"
-      ]
+      "description": "Root web page — Eleventy site + tooling. One PR for all root npm deps (dev + prod).",
+      "matchManagers": ["npm"],
+      "matchFileNames": ["package.json"],
+      "groupName": "npm-web"
     },
     {
-      "description": "npm dev deps — weekly batched. Low-risk; noise control.",
-      "matchManagers": ["npm"],
-      "matchDepTypes": ["devDependencies"],
-      "groupName": "npm-dev",
-      "schedule": ["before 09:00 on monday"]
+      "description": "GitHub Actions — workflow action references. One PR for all action bumps.",
+      "matchManagers": ["github-actions"],
+      "matchFileNames": [".github/workflows/*"],
+      "groupName": "github-actions"
     },
     {
-      "description": "npm prod deps — weekly batched. Higher risk; smoke gates the merge.",
-      "matchManagers": ["npm"],
-      "matchDepTypes": ["dependencies"],
-      "groupName": "npm-prod",
-      "schedule": ["before 09:00 on monday"]
+      "matchFileNames": ["cloudformation/scenarios/ai-contact-centre/**"],
+      "groupName": "scenario-ai-contact-centre"
     },
     {
-      "description": "Drupal composer deps. Same cadence as npm-prod.",
-      "matchManagers": ["composer"],
-      "groupName": "composer",
-      "schedule": ["before 09:00 on monday"]
+      "matchFileNames": ["cloudformation/scenarios/all-demo/**"],
+      "groupName": "scenario-all-demo"
     },
     {
-      "description": "GitHub Actions — workflow action references. Weekly batched; action bumps rarely break. pinDigests scoped to OUR workflows; third-party actions in docker-build scripts (renovatebot/github-action etc.) keep their explicit digest pins because the workflow author already chose them.",
-      "matchManagers": ["github-actions"],
-      "matchFileNames": [".github/workflows/*"],
-      "groupName": "github-actions",
-      "schedule": ["before 09:00 on monday"]
+      "matchFileNames": ["cloudformation/scenarios/bops-planning/**"],
+      "groupName": "scenario-bops-planning"
     },
     {
-      "description": "Pin official actions/* and aws-actions/* references in workflows to digest. Other action sources (community / vendor-specific) keep their existing pin shape — pinning everything caused a firehose in past adoption.",
-      "matchManagers": ["github-actions"],
-      "pinDigests": true,
-      "matchPackageNames": [
-        "/^actions//",
-        "/^aws-actions//"
-      ]
+      "matchFileNames": ["cloudformation/scenarios/council-chatbot/**"],
+      "groupName": "scenario-council-chatbot"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/digital-planning-register/**"],
+      "groupName": "scenario-digital-planning-register"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/fixmystreet/**"],
+      "groupName": "scenario-fixmystreet"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/foi-redaction/**"],
+      "groupName": "scenario-foi-redaction"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/localgov-drupal/**"],
+      "groupName": "scenario-localgov-drupal"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/localgov-ims/**"],
+      "groupName": "scenario-localgov-ims"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/minute/**"],
+      "groupName": "scenario-minute"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/paperless-ngx/**"],
+      "groupName": "scenario-paperless-ngx"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/planning-ai/**"],
+      "groupName": "scenario-planning-ai"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/planx/**"],
+      "groupName": "scenario-planx"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/quicksight-dashboard/**"],
+      "groupName": "scenario-quicksight-dashboard"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/simply-readable/**"],
+      "groupName": "scenario-simply-readable"
+    },
+    {
+      "matchFileNames": ["cloudformation/scenarios/smart-car-park/**"],
+      "groupName": "scenario-smart-car-park"
     },
     {
-      "description": "Python pip Lambda layer deps — batched weekly with npm-dev cadence.",
-      "matchManagers": ["pip_requirements", "pip-compile"],
-      "groupName": "pip",
-      "schedule": ["before 09:00 on monday"]
+      "matchFileNames": ["cloudformation/scenarios/text-to-speech/**"],
+      "groupName": "scenario-text-to-speech"
     }
   ],
   "prConcurrentLimit": 6,