renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":semanticCommits",
    ":dependencyDashboard",
    "helpers:pinGitHubActionDigestsToSemver"
  ],
  "schedule": ["before 6pm on friday"],
  "timezone": "America/New_York",
  "assignees": ["bakerkj"],
  "pre-commit": {
    "enabled": true
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "GitHub runner versions in shell scripts and YAML within workflows",
      "managerFilePatterns": ["/.github/workflows/.+\\.ya?ml$/"],
      "matchStrings": [
        "runner=\"(?<depName>ubuntu|macos|windows)-(?<currentValue>[\\w.-]+)\"",
        "runs-on:\\s*(?<depName>ubuntu|macos|windows)-(?<currentValue>[\\w.-]+)"
      ],
      "datasourceTemplate": "github-runners"
    },
    {
      "customType": "regex",
      "description": "npm packages pinned via pre-commit additional_dependencies (e.g. @commitlint/config-conventional@N in .pre-commit-config.yaml). The built-in pre-commit manager only bumps the `rev:` on each hook — it doesn't touch the additional_dependencies array. Standardized permissive form matches both @scoped and unscoped packages across all sibling repos.",
      "managerFilePatterns": ["/^\\.pre-commit-config\\.yaml$/"],
      "matchStrings": [
        "\"(?<depName>@?[^\"@\\s]+)@(?<currentValue>[^\"\\s]+)\""
      ],
      "datasourceTemplate": "npm",
      "versioningTemplate": "npm"
    },
    {
      "customType": "regex",
      "description": "uv tool required-version pin in pyproject.toml [tool.uv]",
      "managerFilePatterns": ["/(^|/)pyproject\\.toml$/"],
      "matchStrings": ["required-version\\s*=\\s*\"(?<currentValue>[^\"]+)\""],
      "depNameTemplate": "uv",
      "datasourceTemplate": "pypi",
      "versioningTemplate": "pep440"
    }
  ],
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "groupName": "github-actions"
    },
    {
      "matchManagers": ["pre-commit"],
      "groupName": "pre-commit hooks"
    },
    {
      "description": "Auto-merge rules below are order-dependent: renovate applies packageRules in array order and the last match wins. Deny anything that could reach a shipped artifact, so a future Dockerfile or runtime requirement defaults to manual review.",
      "matchDatasources": [
        "docker",
        "deb",
        "custom.aports",
        "github-releases",
        "git-refs",
        "github-tags"
      ],
      "automerge": false
    },
    {
      "description": "Actions are CI-only here: HACS ships the repo source, so nothing an action does reaches a user. Re-enables github-tags, denied above.",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "Lint and format tooling. Never shipped.",
      "matchManagers": ["pre-commit"],
      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "npm packages pinned in .pre-commit-config.yaml additional_dependencies. These come from the custom regex manager, which renovate names custom.regex, so the pre-commit rule above does not reach them.",
      "matchManagers": ["custom.regex"],
      "matchDatasources": ["npm"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "CI runner images.",
      "matchDatasources": ["github-runners"],
      "matchUpdateTypes": ["minor", "patch", "pin"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "Dev and test tooling only, scoped by depType: dependency-groups and tool.uv.dev-dependencies. Deliberately excludes project.dependencies, project.optional-dependencies and build-system.requires, so a runtime dependency added later defaults to manual review instead of inheriting auto-merge -- the pypi datasource is not in the denial above, so scoping here is the only guard. Repos that already ship runtime packages also deny them by name in the final rule. Only pep621 is listed because renovate has no separate uv manager: pep621 is the manager that handles uv projects, covering pyproject.toml, uv.lock and uv workspaces, so naming uv here would match nothing.",
      "matchManagers": ["pep621"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "matchDepTypes": ["dependency-groups", "tool.uv.dev-dependencies"]
    },
    {
      "description": "The uv required-version pin in [tool.uv], which comes from the custom regex manager rather than the native pep621 manager and so is not covered by the rule above. Scoped by depName so it does not sweep in the other custom.regex managers.",
      "matchManagers": ["custom.regex"],
      "matchDepNames": ["uv"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "3 days",
      "automerge": true
    },
    {
      "description": "Majors always get a human. Must stay last to override every opt-in above.",
      "matchUpdateTypes": ["major"],
      "automerge": false
    }
  ],
  "prConcurrentLimit": 5,
  "automergeStrategy": "squash"
}