# renovate

Shared Renovate preset for project repositories. Public on purpose: most project
repos are private and some are public, and a preset that lives in a private repo
resolves for the bot only, while leaking the private repo path to everyone else.
There are no secrets here, only rules.

Use it from a project repo as the whole of its `renovate.jsonc`:

```json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["local>templates/renovate"]
}
```

What it does: docker digests, patches and minors merge themselves after a
three day wait; docker majors and database majors wait for a click on the
dependency dashboard; code dependencies (npm, pip, go.mod, actions) are
collected into one pull request per repo and never merge themselves. Registries
without a release timestamp get the `wait-3d` label instead, and the age gate
merges those. The edge (`caddy/**`), `_legacy/**` and worktree compose files are
out of scope.

The repo has to carry the `renovate`, `wait-3d` and `deps-code` labels before
the first run: Renovate fails on a label that does not exist.

Extending this preset does NOT subscribe a repo to anything. The bot only visits
repos listed in `repositories` in its own config
(`projects/personal/renovate/renovate-config.js` in `infra/komodo`).

`infra/komodo` deliberately does not use this preset: it is the private infra
repo, its scope is a set of `includePaths` and it only ever looks at
docker-compose.