feat: shared Renovate preset for project repos

README.md

@@ -0,0 +1,34 @@
+# renovate
+
+Shared Renovate preset for project repositories. Public on purpose: most project
+repos are private and some are public, and a preset that lives in a private repo
+resolves for the bot only, while leaking the private repo path to everyone else.
+There are no secrets here, only rules.
+
+Use it from a project repo as the whole of its `renovate.jsonc`:
+
+```json
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>templates/renovate"]
+}
+```
+
+What it does: docker digests, patches and minors merge themselves after a
+three day wait; docker majors and database majors wait for a click on the
+dependency dashboard; code dependencies (npm, pip, go.mod, actions) are
+collected into one pull request per repo and never merge themselves. Registries
+without a release timestamp get the `wait-3d` label instead, and the age gate
+merges those. The edge (`caddy/**`), `_legacy/**` and worktree compose files are
+out of scope.
+
+The repo has to carry the `renovate`, `wait-3d` and `deps-code` labels before
+the first run: Renovate fails on a label that does not exist.
+
+Extending this preset does NOT subscribe a repo to anything. The bot only visits
+repos listed in `repositories` in its own config
+(`projects/personal/renovate/renovate-config.js` in `infra/komodo`).
+
+`infra/komodo` deliberately does not use this preset: it is the private infra
+repo, its scope is a set of `includePaths` and it only ever looks at
+docker-compose.

default.json

@@ -0,0 +1,144 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard"
+  ],
+  "timezone": "Europe/Warsaw",
+  "enabledManagers": [
+    "docker-compose",
+    "dockerfile",
+    "npm",
+    "bun",
+    "pep621",
+    "pip_requirements",
+    "gomod",
+    "github-actions"
+  ],
+  "ignorePaths": [
+    "**/caddy/**",
+    "_legacy/**",
+    "**/docker-compose.worktree.yml"
+  ],
+  "pinDigests": true,
+  "minimumReleaseAge": "3 days",
+  "minimumReleaseAgeBehaviour": "timestamp-required",
+  "internalChecksFilter": "strict",
+  "labels": [
+    "renovate"
+  ],
+  "rebaseWhen": "behind-base-branch",
+  "platformAutomerge": true,
+  "automergeStrategy": "squash",
+  "prHourlyLimit": 8,
+  "prConcurrentLimit": 25,
+  "packageRules": [
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchUpdateTypes": [
+        "patch",
+        "minor",
+        "digest",
+        "pinDigest"
+      ],
+      "automerge": true
+    },
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchUpdateTypes": [
+        "pin",
+        "pinDigest"
+      ],
+      "groupName": null,
+      "automerge": true
+    },
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false,
+      "dependencyDashboardApproval": true
+    },
+    {
+      "matchPackageNames": [
+        "postgres",
+        "docker.io/library/postgres",
+        "postgis/postgis",
+        "redis",
+        "docker.io/library/redis",
+        "mongo",
+        "docker.io/library/mongo",
+        "mariadb",
+        "docker.io/library/mariadb",
+        "timescale/timescaledb"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false,
+      "dependencyDashboardApproval": true
+    },
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/**",
+        "lscr.io/**",
+        "quay.io/**",
+        "public.ecr.aws/**",
+        "docker.elastic.co/**"
+      ],
+      "minimumReleaseAgeBehaviour": "timestamp-optional",
+      "automerge": false,
+      "addLabels": [
+        "wait-3d"
+      ]
+    },
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchCurrentValue": "/^(latest|stable|main|edge|main-stable|latest-full|s6|dind)$/",
+      "minimumReleaseAgeBehaviour": "timestamp-optional",
+      "automerge": false,
+      "addLabels": [
+        "wait-3d"
+      ]
+    },
+    {
+      "matchDatasources": [
+        "!docker"
+      ],
+      "matchUpdateTypes": [
+        "pin",
+        "patch",
+        "minor",
+        "digest",
+        "pinDigest"
+      ],
+      "groupName": "code dependencies",
+      "automerge": false,
+      "addLabels": [
+        "deps-code"
+      ]
+    },
+    {
+      "matchDatasources": [
+        "!docker"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false,
+      "dependencyDashboardApproval": true
+    }
+  ]
+}