romm/renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":semanticCommitTypeAll(chore)"],
  "description": "Updates wait out a week before Renovate proposes them, so a compromised release has time to be pulled before it reaches a PR here.",
  "minimumReleaseAge": "7 days",
  "enabledManagers": [
    "github-actions",
    "docker-compose",
    "npm",
    "pep621",
    "custom.regex"
  ],
  "ignorePaths": ["examples/**"],
  "packageRules": [
    {
      "description": "One PR per service, since each tag is repeated across several workflows and compose files.",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["mariadb"],
      "groupName": "mariadb"
    },
    {
      "description": "The shipped image installs valkey from Alpine's package repo, currently the 9.0 line. Hold the test pins there so they keep matching what users run, and raise this bound deliberately when ALPINE_VERSION in docker/Dockerfile moves.",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["valkey/valkey"],
      "groupName": "valkey",
      "allowedVersions": "<9.1"
    },
    {
      "description": "TypeScript 7 ships no JavaScript compiler API, which vue-tsc, typescript-eslint and vue-component-meta load. Raise this bound once they support it.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["typescript"],
      "allowedVersions": "<7"
    },
    {
      "description": "From 0.30, json-schema-ref-parser 14 refuses localhost URLs, so `npm run generate` can't read the schema from the local backend. The CLI has no flag to allow them.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["openapi-typescript-codegen"],
      "allowedVersions": "<0.30"
    },
    {
      "matchDatasources": ["docker"],
      "matchPackageNames": ["postgres"],
      "groupName": "postgres"
    },
    {
      "matchManagers": ["github-actions"],
      "matchDepTypes": ["action"],
      "groupName": "github actions"
    },
    {
      "description": "Keep the ranges maintainers chose in package.json and pyproject.toml; in-range updates only refresh the lockfile.",
      "matchManagers": ["npm", "pep621"],
      "rangeStrategy": "update-lockfile"
    },
    {
      "description": "rom-patcher is pinned to a git tag, and its lockfile entry carries the version from upstream's package.json, stuck at 3.0.0. Compare the tag itself, or Renovate keeps proposing the tag already pinned.",
      "matchManagers": ["npm"],
      "matchPackageNames": ["rom-patcher"],
      "rangeStrategy": "replace"
    },
    {
      "description": "One weekly PR per ecosystem for minor and patch updates, so app dependencies don't open a PR each.",
      "matchManagers": ["npm"],
      "matchFileNames": ["frontend/package.json"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "frontend dependencies",
      "schedule": ["before 6am on monday"]
    },
    {
      "matchManagers": ["pep621"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "backend dependencies",
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "Major updates usually need code changes, so they wait for approval on the Dependency Dashboard.",
      "matchManagers": ["npm", "pep621"],
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true
    }
  ],
  "customManagers": [
    {
      "description": "Image tags built at runtime in workflow steps, marked with a renovate comment. Legs deliberately left unmarked stay pinned.",
      "customType": "regex",
      "managerFilePatterns": ["/^\\.github/workflows/[^/]+\\.ya?ml$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>[^\\s]+?)\\s+-?\\s*[A-Za-z0-9_-]+?: [\"'](?<currentValue>[^\"'\\s]+)[\"']"
      ],
      "versioningTemplate": "docker"
    },
    {
      "description": "The Trunk plugins release in .trunk/trunk.yaml, which no built-in manager reads. The CLI version publishes no release dates, so minimumReleaseAge can't gate it and it stays a manual bump.",
      "customType": "regex",
      "managerFilePatterns": ["/^\\.trunk/trunk\\.yaml$/"],
      "matchStrings": [
        "- id: trunk\\s+ref: (?<currentValue>v[^\\s]+)\\s+uri: https://github\\.com/(?<depName>trunk-io/plugins)\\s"
      ],
      "datasourceTemplate": "github-tags"
    }
  ]
}