coding-style/default.json at main · matchory/coding-style · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "description": [
    "Organisation-wide Renovate base for Matchory repositories.",
    "Extend it by name rather than copying, the same way the style presets work:",
    "  { \"extends\": [\"github>matchory/coding-style\"] }",
    "Ecosystem presets live alongside it and are extended by path:",
    "  { \"extends\": [\"github>matchory/coding-style\", \"github>matchory/coding-style//renovate/php\"] }",
    "Sets a repository-wide minimumReleaseAge cooldown. Most malicious npm and PyPI releases are detected and yanked within hours, so waiting a few days converts that class of supply-chain attack into a non-event without anyone needing to be watching at the right moment."
  ],
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    ":maintainLockFilesWeekly",
    "github>matchory/coding-style//renovate/coding-style-consumer"
  ],
  "timezone": "Europe/Berlin",
  "schedule": [
    "* 0-6 * * 1"
  ],
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "rebaseWhen": "conflicted",
  "minimumReleaseAge": "5 days",
  "internalChecksFilter": "strict",
  "labels": [
    "dependencies"
  ],
  "commitMessageAction": "bump",
  "packageRules": [
    {
      "description": "Development tooling is low risk and high noise, so batch it into one PR.",
      "matchDepTypes": [
        "devDependencies",
        "require-dev"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch"
      ],
      "groupName": "dev tooling (non-major)"
    },
    {
      "description": [
        "GitHub Actions are pinned by tag and bumped together. Renovate cannot tell a breaking",
        "action major from a safe one, so these stay separate from the code dependencies."
      ],
      "matchManagers": [
        "github-actions"
      ],
      "groupName": "github actions"
    },
    {
      "description": [
        "A major bump to a linter or formatter reformats or re-flags an entire codebase. Never",
        "automerge those, regardless of what config:recommended would allow."
      ],
      "matchPackageNames": [
        "eslint",
        "laravel/pint",
        "oxfmt",
        "oxlint",
        "phpstan/phpstan",
        "rector/rector",
        "ruff",
        "typescript"
      ],
      "matchUpdateTypes": [
        "major"
      ],
      "automerge": false,
      "minimumReleaseAge": "7 days",
      "addLabels": [
        "reformat-risk"
      ]
    }
  ],
  "vulnerabilityAlerts": {
    "description": [
      "Security fixes bypass the schedule and the concurrency limits.",
      "GitHub's own Dependabot *security* updates can stay enabled alongside this: they only open",
      "PRs for advisories, so they do not duplicate Renovate's version updates. Do NOT also enable",
      "Dependabot *version* updates (a dependabot.yml with `schedule`), or every bump arrives twice."
    ],
    "labels": [
      "security"
    ],
    "schedule": [
      "at any time"
    ],
    "prCreation": "immediate",
    "minimumReleaseAge": null
  },
  "osvVulnerabilityAlerts": true
}