renovate

Shared Renovate preset for project repositories. Public on purpose: most project repos are private and some are public, and a preset that lives in a private repo resolves for the bot only, while leaking the private repo path to everyone else. There are no secrets here, only rules.

Use it from a project repo as the whole of its renovate.jsonc:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["local>templates/renovate"]
}

What it does: docker digests, patches and minors merge themselves after a three day wait; docker majors and database majors wait for a click on the dependency dashboard; code dependencies (npm, pip, go.mod, actions) are collected into one pull request per repo, which merges itself after the same three day wait; code majors wait for a click on the dependency dashboard and merge themselves once approved. Registries without a release timestamp get the wait-3d label instead, and the age gate merges those. The edge (caddy/**), _legacy/** and worktree compose files are out of scope.

The repo has to carry the renovate, wait-3d and deps-code labels before the first run: Renovate fails on a label that does not exist.

Extending this preset does NOT subscribe a repo to anything. The bot only visits repos listed in repositories in its own config (projects/personal/renovate/renovate-config.js in infra/komodo).

infra/komodo deliberately does not use this preset: it is the private infra repo, its scope is a set of includePaths and it only ever looks at docker-compose.