feat: shared Renovate preset for project repos

README.md

@@ -0,0 +1,34 @@
+# renovate
+
+Shared Renovate preset for project repositories. Public on purpose: most project
+repos are private and some are public, and a preset that lives in a private repo
+resolves for the bot only, while leaking the private repo path to everyone else.
+There are no secrets here, only rules.
+
+Use it from a project repo as the whole of its `renovate.jsonc`:
+
+```json
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>templates/renovate"]
+}
+```
+
+What it does: docker digests, patches and minors merge themselves after a
+three day wait; docker majors and database majors wait for a click on the
+dependency dashboard; code dependencies (npm, pip, go.mod, actions) are
+collected into one pull request per repo and never merge themselves. Registries
+without a release timestamp get the `wait-3d` label instead, and the age gate
+merges those. The edge (`caddy/**`), `_legacy/**` and worktree compose files are
+out of scope.
+
+The repo has to carry the `renovate`, `wait-3d` and `deps-code` labels before
+the first run: Renovate fails on a label that does not exist.
+
+Extending this preset does NOT subscribe a repo to anything. The bot only visits
+repos listed in `repositories` in its own config
+(`projects/personal/renovate/renovate-config.js` in `infra/komodo`).
+
+`infra/komodo` deliberately does not use this preset: it is the private infra
+repo, its scope is a set of `includePaths` and it only ever looks at
+docker-compose.