pi-stack-ops/renovate.json at main · iamfj/pi-stack-ops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    ":semanticCommitTypeAll(chore)",
    ":pinGitHubActionDigests",
    ":prHourlyLimit1",
    ":prConcurrentLimit3"
  ],
  "timezone": "Europe/Berlin",
  "schedule": ["before 6am on monday"],
  "labels": ["dependencies"],
  "assigneesFromCodeOwners": true,
  "dependencyDashboardTitle": "Dependency Dashboard",
  "dependencyDashboardApproval": true,
  "dependencyDashboardOSVVulnerabilitySummary": "all",
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["dependencies", "security"],
    "assigneesFromCodeOwners": true,
    "dependencyDashboardApproval": false,
    "schedule": []
  },
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on monday"],
    "dependencyDashboardApproval": true
  },
  "minimumReleaseAge": "3 days",
  "internalChecksFilter": "strict",
  "ignoreScripts": true,
  "rangeStrategy": "bump",
  "separateMajorMinor": true,
  "separateMultipleMajor": true,
  "rebaseWhen": "conflicted",
  "automerge": false,
  "platformAutomerge": false,
  "ignorePaths": [
    "node_modules/**",
    "dist/**",
    "bin/stack-ops.js",
    ".pi/**",
    ".stack-ops/**"
  ],
  "packageRules": [
    {
      "description": "Keep GitHub Actions together and pinned to digests.",
      "matchManagers": ["github-actions"],
      "groupName": "github-actions",
      "labels": ["dependencies", "ci"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "Group non-major Bun/npm development tooling updates.",
      "matchManagers": ["bun", "npm"],
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "dev tooling",
      "labels": ["dependencies", "tooling"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "Group TypeScript and Node/Bun type packages.",
      "matchPackageNames": ["typescript", "@types/**"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "typescript types and compiler",
      "labels": ["dependencies", "tooling"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "Keep semantic-release ecosystem updates together.",
      "matchPackageNames": ["semantic-release", "@semantic-release/**"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "semantic-release",
      "labels": ["dependencies", "release"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "Group non-major production dependency updates separately from tooling.",
      "matchManagers": ["bun", "npm"],
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "production dependencies",
      "labels": ["dependencies", "runtime"],
      "dependencyDashboardApproval": true
    },
    {
      "description": "Never batch major updates; require explicit dashboard approval.",
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true,
      "labels": ["dependencies", "breaking-change"]
    },
    {
      "description": "Security fixes should be prompt and visible, not blocked by the weekly schedule.",
      "matchDatasources": ["osv"],
      "labels": ["dependencies", "security"],
      "dependencyDashboardApproval": false,
      "schedule": [],
      "minimumReleaseAge": null
    }
  ]
}