|
1 | 1 | { |
2 | 2 | "$schema": "https://docs.renovatebot.com/renovate-schema.json", |
3 | | - "extends": ["config:recommended", "helpers:pinGitHubActionDigestsToSemver"], |
4 | | - "enabledManagers": ["github-actions", "npm"], |
5 | | - "prConcurrentLimit": 3, |
6 | | - "prHourlyLimit": 2, |
7 | | - "schedule": ["* 0-5 * * 1"], |
8 | | - "labels": ["dependencies", "automated"], |
9 | | - "commitMessagePrefix": "chore(deps):", |
10 | | - "osvVulnerabilityAlerts": true, |
11 | | - "vulnerabilityAlerts": { |
12 | | - "labels": ["security", "supply-chain"] |
13 | | - }, |
14 | | - "packageRules": [ |
15 | | - { |
16 | | - "description": "Keep npm dependencies and pnpm catalogs on exact versions; preserve engine and peer compatibility ranges.", |
17 | | - "matchManagers": ["npm"], |
18 | | - "matchDepTypes": ["!engines", "!peerDependencies"], |
19 | | - "rangeStrategy": "pin" |
20 | | - }, |
21 | | - { |
22 | | - "description": "Group exact-version and action SHA pinning into one PR, available any time.", |
23 | | - "matchUpdateTypes": ["pin", "pinDigest"], |
24 | | - "groupName": "dependency pins", |
25 | | - "groupSlug": "dependency-pins", |
26 | | - "schedule": ["at any time"] |
27 | | - }, |
28 | | - { |
29 | | - "description": "Everything non-major (actions + npm) batches into ONE weekly PR. 3-day soak guards against compromised/yanked releases. Majors excluded (handled below).", |
30 | | - "matchUpdateTypes": ["digest", "minor", "patch"], |
31 | | - "groupName": "weekly dependency updates", |
32 | | - "groupSlug": "weekly-dependency-updates", |
33 | | - "minimumReleaseAge": "3 days", |
34 | | - "prCreation": "not-pending" |
35 | | - }, |
36 | | - { |
37 | | - "description": "Major updates stay individual and gated so a human verifies each for breaking changes. 3-day soak + dashboard approval + breaking label.", |
38 | | - "matchUpdateTypes": ["major"], |
39 | | - "minimumReleaseAge": "3 days", |
40 | | - "prCreation": "not-pending", |
41 | | - "dependencyDashboardApproval": true, |
42 | | - "addLabels": ["breaking"] |
43 | | - }, |
44 | | - { |
45 | | - "description": "Runner images and toolchain versions (go, node, etc.) are infra decisions, not action pinning -- leave them alone.", |
46 | | - "matchManagers": ["github-actions"], |
47 | | - "matchDepTypes": ["github-runner", "uses-with"], |
48 | | - "enabled": false |
49 | | - } |
50 | | - ] |
| 3 | + "extends": ["local>berachain/renovate-config:dapps"] |
51 | 4 | } |
0 commit comments