default.json

{
  // Shared Renovate preset for HyperbolicLabs repos.
  //
  // Use it from a repo's own renovate.json5 with:
  //   extends: ["github>HyperbolicLabs/.github"]
  // and keep ONLY that repo's manager-specific rules locally (Go rules
  // in forge, argocd/terraform/Kargo rules in forge-infra, etc.).
  //
  // Why this exists: common policy (schedule, PR caps, commit prefix,
  // the github-actions grouping) used to be copy-pasted into each repo's
  // renovate.json5 and drifted. The narrow-schedule bug that starved PR
  // creation was duplicated in every repo. Defining it once here fixes
  // that class of problem.
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  // config:best-practices = config:recommended plus the hardening presets
  // (pin GitHub Action + Docker digests, config-migration PRs, unpublish-safe
  // npm, etc.). It's Renovate's current recommended baseline for teams.
  extends: ["config:best-practices"],

  // Weekly on Mondays, all-day cron window on purpose. Mend's hosted
  // scanner runs each repo only a few times a day, so a narrow
  // "before 6am on monday" slot was too small to reliably catch a run —
  // updates sat in "Awaiting Schedule" and no PR ever opened. All-day
  // Monday keeps the weekly cadence but is wide enough for a scan to
  // land in-window.
  schedule: ["* * * * 1"],
  timezone: "America/Los_Angeles",

  labels: ["dependencies"],

  // Default Renovate commit prefix would fail our conventional-title CI
  // gate. Use `chore:` (also what Dependabot used).
  commitMessagePrefix: "chore:",

  // Soft caps so a Monday batch doesn't dump dozens of PRs into review
  // at once.
  prConcurrentLimit: 10,
  prHourlyLimit: 2,

  // Open CVE-flagged bumps immediately, off-schedule. Renovate reads
  // GitHub's Dependabot alert feed for each repo and, on a hit, opens a
  // PR the moment the alert appears — bypassing the Monday cron. Normal
  // dep bumps still batch on the weekly cadence; security-flagged ones
  // don't wait up to seven days. Depends on Dependabot Security Alerts
  // being on at the org/repo level (Settings → Code security), which
  // was already the standing policy before Renovate replaced Dependabot.
  vulnerabilityAlerts: {
    enabled: true,
    labels: ["security"],
  },

  packageRules: [
    {
      description: "Bundle GitHub Actions bumps into one PR. Workflows pin actions to SHAs, so each PR carries the new tag-comment automatically. Repo-local packageRules append to this.",
      matchManagers: ["github-actions"],
      groupName: "github-actions",
    },
    {
      // Automerge is deliberately scoped to GitHub Actions only. Action
      // bumps are SHA-pinned and only affect CI workflows (never prod), and
      // Renovate waits for required status checks before merging — so a bad
      // bump is caught by CI, not shipped. We intentionally do NOT automerge
      // terraform / argocd / gomod: those are reviewed (and in forge-infra a
      // terraform bump auto-applies to prod on merge). Majors are excluded so
      // a breaking action version still gets eyes.
      description: "Automerge low-risk GitHub Actions bumps (digest re-pins + minor/patch); majors stay for review.",
      matchManagers: ["github-actions"],
      matchUpdateTypes: ["digest", "pin", "pinDigest", "minor", "patch"],
      automerge: true,
    },
  ],
}