renovate/README.md

renovate

Shared Renovate preset for project repositories. Public on purpose: most project repos are private and some are public, and a preset that lives in a private repo resolves for the bot only, while leaking the private repo path to everyone else. There are no secrets here, only rules.

Use it from a project repo as the whole of its renovate.jsonc:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["local>templates/renovate"]
}

What it does: docker digests, patches and minors merge themselves after a three day wait; docker majors and database majors wait for a click on the dependency dashboard; code dependencies (npm, pip, go.mod, actions) are collected into one pull request per repo, which merges itself after the same three day wait; code majors wait for a click on the dependency dashboard and merge themselves once approved. Registries without a release timestamp get the wait-3d label instead, and the age gate merges those. The edge (caddy/**), _legacy/** and worktree compose files are out of scope.

Updates are split across two base branches. Images target the default branch, so an image update deploys as soon as it merges. Code dependencies target dev and never touch the default branch on their own; you pull dev and merge it yourself when you want that code in production. The split is two matchBaseBranches rules, so the same update is never offered on both branches. A repo using this preset therefore needs a dev branch.

The repo has to carry the renovate, wait-3d and deps-code labels before the first run: Renovate fails on a label that does not exist. It also has to have a dev branch, otherwise Renovate skips that base branch and code updates are never proposed.

Extending this preset does NOT subscribe a repo to anything. The bot only visits repos listed in repositories in its own config (projects/personal/renovate/renovate-config.js in infra/komodo).

infra/komodo deliberately does not use this preset: it is the private infra repo, its scope is a set of includePaths and it only ever looks at docker-compose.