wet/renovate.json at main · n24q02m/wet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":semanticCommits"
  ],
  "schedule": [
    "before 5am"
  ],
  "timezone": "Asia/Ho_Chi_Minh",
  "prConcurrentLimit": 5,
  "prHourlyLimit": 3,
  "labels": [
    "dependencies"
  ],
  "rangeStrategy": "widen",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": [
      "before 5am"
    ],
    "automerge": true,
    "automergeType": "pr",
    "commitMessageAction": "lock file maintenance"
  },
  "packageRules": [
    {
      "description": "Hold every update for 7 days so a malicious or yanked release is caught before it lands",
      "matchPackageNames": ["*"],
      "minimumReleaseAge": "7 days"
    },
    {
      "matchCategories": [
        "golang"
      ],
      "postUpdateOptions": [
        "gomodTidy"
      ],
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Group minor updates for review (prod scope by default)",
      "matchUpdateTypes": [
        "minor"
      ],
      "groupName": "minor dependencies",
      "groupSlug": "all-minor",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-merge dev-scope minor updates after cooldown",
      "matchUpdateTypes": [
        "minor"
      ],
      "matchDepTypes": [
        "devDependencies",
        "dependency-groups",
        "tool.uv.dev-dependencies",
        "tool.pdm.dev-dependencies"
      ],
      "groupName": "non-major dev dependencies",
      "groupSlug": "non-major-dev",
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-merge patch updates after cooldown",
      "matchUpdateTypes": [
        "patch"
      ],
      "groupName": "patch dependencies",
      "groupSlug": "all-patch",
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Auto-merge GitHub Actions digest updates after cooldown",
      "matchManagers": [
        "github-actions"
      ],
      "matchUpdateTypes": [
        "digest",
        "pinDigest"
      ],
      "groupName": "github-actions digests",
      "groupSlug": "gha-digests",
      "automerge": true,
      "automergeType": "pr",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin GitHub Actions to SHA for security",
      "matchManagers": [
        "github-actions"
      ],
      "pinDigests": true,
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin PSR to v10 — block Renovate downgrades",
      "matchPackageNames": [
        "/^python-semantic-release//"
      ],
      "matchManagers": [
        "github-actions"
      ],
      "allowedVersions": ">=10.0.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin Python runtime to 3.13.x",
      "matchPackageNames": [
        "python"
      ],
      "allowedVersions": ">=3.13.0 <3.14.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin Node.js runtime to 24.x",
      "matchPackageNames": [
        "node"
      ],
      "allowedVersions": ">=24.0.0 <25.0.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Pin Java runtime to 21.x LTS",
      "matchPackageNames": [
        "java"
      ],
      "allowedVersions": ">=21.0.0 <22.0.0",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Disable runtime version updates from mise (pinned in CLAUDE.md)",
      "matchManagers": [
        "mise"
      ],
      "matchDepNames": [
        "python",
        "node",
        "java"
      ],
      "enabled": false,
      "minimumReleaseAge": "7 days"
    }
  ],
  "semanticCommits": "enabled",
  "commitMessagePrefix": "fix(deps):",
  "commitMessageAction": "update",
  "commitMessageTopic": "{{depName}}",
  "semanticCommitType": "fix",
  "semanticCommitScope": "deps"
}