Renovate Config

Shared Renovate presets that control dependency updates across Ghost Foundation repositories.

Using the presets

Reference the appropriate preset from a dedicated Renovate configuration file in the consuming repository:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["local>TryGhost/renovate-config"]
}

Use a named preset when the repository needs a more specific policy:

Preset	Reference	Purpose
default	local>TryGhost/renovate-config	Extends quiet.json5 with broad automerge and its documented exceptions.
safe	local>TryGhost/renovate-config:safe	Extends default but disables major-update automerge. This preset is an anti-pattern; avoid it and use it only temporarily when unavoidable.
theme	local>TryGhost/renovate-config:theme.json5	Extends quiet.json5 with rules for Ghost theme repositories.
terraform	local>TryGhost/renovate-config:terraform.json5	Applies Terraform-specific labels, version limits, and automerge policy.

quiet.json5 is the shared policy layer behind the default and theme presets. Consuming repositories should normally select one of the public presets above rather than extend it directly.

Validating changes

The test harness uses the Node.js version declared in .nvmrc. The test workflow is the source of truth for the Renovate version used in CI. For local validation, use npx to make Renovate temporarily available to the harness without adding a global or repository dependency:

nvm install
nvm use
npx --yes --package=renovate --call './test/run.sh'

The test command validates every configuration file, applies strict validation where the current presets support it, resolves every consumable preset and the legacy named alias through a temporary loopback server, asserts their effective policies, and runs dependency extraction against npm and Terraform fixtures.

Live repository dry run

The local test harness does not need GitHub credentials. To exercise a preset against the live TryGhost/Ghost repository, create a personal access token following Renovate's GitHub authentication guidance and expose it as GITHUB_RENOVATE_TOKEN through your shell or secret manager. Then run from the repository root:

RENOVATE_CONFIG_FILE="$PWD/quiet.json5" \
RENOVATE_TOKEN="$GITHUB_RENOVATE_TOKEN" \
npx --yes --package=renovate renovate \
  --platform=github \
  --dry-run=full \
  TryGhost/Ghost

Change RENOVATE_CONFIG_FILE when testing a different preset. Never commit or print the token.

Preset changes affect repositories across the Ghost Foundation organization. Keep changes narrowly scoped and use the full test command before opening a pull request.

Copyright & License

Copyright (c) 2013-2026 Ghost Foundation - Released under the MIT license.