trueppm/renovate.json at main · TruePPM/trueppm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    ":prHourlyLimit2",
    ":prConcurrentLimit5",
    "group:monorepos",
    "group:recommended"
  ],
  "timezone": "America/Los_Angeles",
  "schedule": [
    "before 10am on monday"
  ],
  "labels": [
    "dependencies",
    "renovate"
  ],
  "prBodyColumns": [
    "Package",
    "Type",
    "Update",
    "Change",
    "Pending"
  ],
  "rangeStrategy": "bump",
  "semanticCommitType": "chore",
  "semanticCommitScope": "deps",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": [
      "before 10am on monday"
    ]
  },
  "packageRules": [
    {
      "description": "Group all Python dependency updates into one PR per ecosystem",
      "matchManagers": ["pip_requirements", "pip_setup", "pep621", "poetry"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "python dependencies",
      "groupSlug": "python-minor-patch"
    },
    {
      "description": "Group all npm devDependency updates",
      "matchManagers": ["npm"],
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "npm devDependencies",
      "groupSlug": "npm-dev-minor-patch"
    },
    {
      "description": "Playwright gets its own PR — a bump needs four coordinated edits, and grouping it would block every unrelated devDependency (#2797). Renovate's gitlabci manager only reads `image:` keys, so it cannot see the bare PLAYWRIGHT_BASE_TAG variable or the Dockerfile ARG; its PR will bump only the two package.json pins and web:playwright-pins will correctly fail it. Ungrouped, that red PR is a standing reminder to do the other two edits by hand, instead of holding a dozen unrelated updates hostage.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["playwright", "playwright-core", "@playwright/test"],
      "groupName": "playwright",
      "groupSlug": "playwright"
    },
    {
      "description": "Group all npm production dependency updates",
      "matchManagers": ["npm"],
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "npm dependencies",
      "groupSlug": "npm-prod-minor-patch"
    },
    {
      "description": "Group all Rust (Cargo) dependency updates",
      "matchManagers": ["cargo"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "rust dependencies",
      "groupSlug": "rust-minor-patch"
    },
    {
      "description": "Project policy (CLAUDE.md): never auto-merge — every dependency MR goes through review and a green pipeline. Renovate opens PRs only.",
      "matchPackageNames": ["*"],
      "automerge": false
    },
    {
      "description": "Major updates — never auto-merge; open individually for review",
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "groupName": null,
      "labels": ["dependencies", "renovate", "major-upgrade"]
    },
    {
      "description": "Django and DRF: pin to LTS branches, no auto-merge on minor",
      "matchPackageNames": [
        "Django",
        "django",
        "djangorestframework",
        "django-channels",
        "channels"
      ],
      "automerge": false
    },
    {
      "description": "React: never auto-merge — major/minor UX surface",
      "matchPackageNames": [
        "react",
        "react-dom",
        "@types/react",
        "@types/react-dom"
      ],
      "automerge": false
    },
    {
      "description": "Security updates — short schedule, no grouping",
      "matchUpdateTypes": ["patch"],
      "vulnerabilityAlerts": {
        "enabled": true,
        "schedule": ["at any time"]
      }
    },
    {
      "description": "Pin all container image digests and keep them current (#904 supply-chain hardening — OpenSSF Scorecard Pinned-Dependencies). Applies to .gitlab-ci.yml image: refs, Dockerfile FROMs, and Helm image values — anything on the docker datasource.",
      "matchDatasources": ["docker"],
      "pinDigests": true
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["dependencies", "security"]
  },
  "docker": {
    "enabled": true
  },
  "gitlabci": {
    "enabled": true
  },
  "helm-values": {
    "enabled": true
  },
  "helmv3": {
    "enabled": true
  }
}