renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":semanticCommits", "helpers:pinGitHubActionDigests"],
  "timezone": "Australia/Melbourne",
  "schedule": ["before 4am on Monday"],
  "labels": ["dependencies", "renovate"],
  "prHourlyLimit": 2,
  "prConcurrentLimit": 2,
  "customManagers": [
    {
      "customType": "regex",
      "managerFilePatterns": ["/(^|/)Dockerfile(\\..+)?$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?:\\s+packageName=(?<packageName>\\S+))?\\s+ARG \\S*_VERSION=(?<currentValue>\\S+)"
      ]
    },
    {
      "customType": "regex",
      "description": "Digest-pinned oven/bun references inside .gitlab-ci.yml script blocks. The gitlabci manager only reads image: keys, so the admission-policy docker run line would otherwise go stale. The (?m)^\\s+ anchor excludes image: lines so nothing is extracted twice.",
      "managerFilePatterns": ["/\\.gitlab-ci\\.ya?ml$/"],
      "matchStrings": [
        "(?m)^\\s+(?<depName>oven/bun):(?<currentValue>[\\w.-]+)@(?<currentDigest>sha256:[a-f0-9]{64})\\s*$"
      ],
      "datasourceTemplate": "docker"
    }
  ],
  "packageRules": [
    {
      "description": "Group GitHub Actions workflow updates into one PR.",
      "matchManagers": ["github-actions"],
      "groupName": "github-actions"
    },
    {
      "description": "Group npm/bun production dependencies into one PR.",
      "matchManagers": ["npm", "bun"],
      "matchDepTypes": ["dependencies"],
      "groupName": "production dependencies"
    },
    {
      "description": "Group npm/bun dev dependencies into one PR.",
      "matchManagers": ["npm", "bun"],
      "matchDepTypes": ["devDependencies"],
      "groupName": "dev dependencies"
    },
    {
      "description": "Group Dockerfile FROM base image updates into one PR.",
      "matchManagers": ["dockerfile"],
      "groupName": "docker base images"
    },
    {
      "description": "Group Dockerfile ARG tool version bumps from the custom regex manager.",
      "matchManagers": ["custom.regex"],
      "groupName": "dockerfile tool versions"
    },
    {
      "description": "Group every Bun pin (.tool-versions, packageManager, Dockerfile FROM, .gitlab-ci.yml images and script refs, plus @types/bun so the types track the runtime) into one PR. Renovate cannot edit the Markdown prose, and it leaves a still-satisfied semver range in package.json engines.bun untouched after bumping the canonical pin elsewhere, while the checker requires an exact match rather than just a satisfied range, so both still need a hand edit; grouping makes that one PR instead of several.",
      "matchDepNames": ["bun", "oven/bun", "@types/bun"],
      "groupName": "bun runtime"
    },
    {
      "description": "Auto-merge non-major bumps across all managers once CI is green. Major bumps open a PR for review.",
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "automerge": true,
      "platformAutomerge": true
    },
    {
      "description": "Strip 'v' prefix: hashicorp/terraform GitHub tags are vX.Y.Z but ARG value is unprefixed.",
      "matchDepNames": ["hashicorp/terraform"],
      "extractVersion": "^v(?<version>.+)$"
    },
    {
      "description": "Strip 'kustomize/' prefix: kubernetes-sigs/kustomize is a monorepo with per-product tags.",
      "matchDepNames": ["kubernetes-sigs/kustomize"],
      "extractVersion": "^kustomize/(?<version>.+)$"
    },
    {
      "description": "Wait 7 days before raising minor/patch/digest PRs to catch bad releases before automerge.",
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "minimumReleaseAge": "7 days",
      "internalChecksFilter": "strict"
    },
    {
      "description": "Wait 14 days before raising major update PRs for manual review stability.",
      "matchUpdateTypes": ["major"],
      "minimumReleaseAge": "14 days",
      "internalChecksFilter": "strict"
    }
  ]
}