renovate.json5

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>projectbluefin/renovate-config:org-inherited-config"
  ],
  // Renovate targets main. All PRs must target main — the CI gate
  // (on-pr-opened-or-updated) blocks any PR not targeting main.
  // Note: track-bst-sources.yml manages BuildStream refs directly and
  // intentionally targets main — it is not Renovate-managed.
  "baseBranchPatterns": ["main"],
  "branchPrefix": "renovate/",

  // Limit Renovate to GitHub Actions and workflow image refs.
  // BuildStream sources are tracked separately by track-bst-sources.yml.
  "enabledManagers": ["github-actions"],

  "packageRules": [
    {
      "description": "Automerge digest/pin/patch/minor when CI passes",
      "matchUpdateTypes": ["digest", "pin", "patch", "minor"],
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash"
    },
    {
      "description": "Group all projectbluefin/actions SHA updates into one atomic PR",
      "matchManagers": ["github-actions"],
      "matchDepNames": ["/projectbluefin\/actions/"],
      "groupName": "projectbluefin/actions",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "labels": ["chore/deps", "automerge"]
    },
    {
      "description": "Pin all GitHub Actions to full SHA digests",
      "matchManagers": ["github-actions"],
      "matchDepTypes": ["action"],
      "pinDigests": true
    },
    {
      // projectbluefin/bonedigger has no versioned releases; @main is intentional.
      // See .github/workflows/bonedigger.yml and docs/skills/ci-tooling.md.
      "matchPackageNames": ["projectbluefin/bonedigger"],
      "enabled": false
    }
  ]
}