default.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "mergeConfidence:all-badges",
    ":semanticCommits",
    "helpers:pinGitHubActionDigests"
  ],
  "dependencyDashboard": false,
  "rebaseWhen": "behind-base-branch",
  "recreateWhen": "always",
  "minimumReleaseAge": "1 day",
  "prConcurrentLimit": 0,
  "prHourlyLimit": 0,
  "lockFileMaintenance": {
    "description": "Refresh lockfiles weekly. This is the one path that bypasses the npm quarantine below: lock file maintenance resolves every transitive dep to whatever the registry serves at that moment, and minimumReleaseAge is not reliably applied to this update type — so a package republished with a malicious version (keyv/cacheable, 2026-08-04) could land here hours after publication. Two gates: the release age is declared explicitly in case the manager does honour it, and automerge is off so the refreshed lockfile is always reviewed by a human before it reaches main.",
    "enabled": true,
    "schedule": ["before 6am on monday"],
    "minimumReleaseAge": "3 days",
    "automerge": false
  },
  "labels": [
    "dependencies"
  ],
  "platformAutomerge": true,
  "onboardingConfig": {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
      "github>FerrLabs/.github"
    ]
  },
  "onboardingConfigFileName": "renovate.json",
  "onboardingPrTitle": "chore: configure Renovate (extend FerrLabs preset)",
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": [
      "security"
    ],
    "automerge": true,
    "automergeType": "pr",
    "automergeStrategy": "squash",
    "minimumReleaseAge": "0"
  },
  "osvVulnerabilityAlerts": true,
  "packageRules": [
    {
      "description": "FerrLabs npm packages — trust them, scan often, merge without delay. Override registry to GHCR (npm.pkg.github.com) since these packages aren't on npmjs.org. Auth comes from RENOVATE_HOST_RULES env in the runner workflow. internalChecksFilter:none skips the stability-days gate inherited from the global default. In practice this rule is belt-and-braces for the registry: each consuming repo's `.npmrc` already carries `@ferrlabs:registry=https://npm.pkg.github.com`, so the lookup resolves without it — the rule is what supplies the automerge/schedule policy.",
      "matchPackageNames": [
        "/^@ferrlabs\\//"
      ],
      "registryUrls": [
        "https://npm.pkg.github.com"
      ],
      "schedule": [
        "* * * * *"
      ],
      "minimumReleaseAge": "0",
      "internalChecksFilter": "none",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "FerrLabs npm packages"
    },
    {
      "description": "FerrFlow npm packages — same trust as the @ferrlabs rule above, minus the registry override. The npm publishes were consolidated under @ferrflow (the `ferrflow` wrapper, `@ferrflow/*`, `@ferrflow/wasm`) and those live on npmjs.org, not GHCR, so pointing them at npm.pkg.github.com would break the lookup. Without this rule the scope falls through to the third-party rule below and its three-day quarantine, which held FerrFlow-Cloud's `@ferrflow/doc` pin four versions behind and kept merged documentation off ferrflow.com.",
      "matchManagers": [
        "npm"
      ],
      "matchPackageNames": [
        "/^@ferrflow\\//",
        "ferrflow"
      ],
      "schedule": [
        "* * * * *"
      ],
      "minimumReleaseAge": "0",
      "internalChecksFilter": "none",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "FerrFlow npm packages"
    },
    {
      "description": "FerrLabs Kit crates pinned via git rev — scan often, merge without delay. Targets the depName the customManager below stamps (`FerrLabs/Kit`); `matchPackageNames` would compare against the packageName field (the full URL), so use matchDepNames here. internalChecksFilter:none skips stability-days.",
      "matchManagers": [
        "custom.regex"
      ],
      "matchDepNames": [
        "FerrLabs/Kit"
      ],
      "schedule": [
        "* * * * *"
      ],
      "minimumReleaseAge": "0",
      "internalChecksFilter": "none",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "FerrLabs Kit"
    },
    {
      "description": "FerrLabs Cargo crates published from Kit (`ferrlabs-*`) — same trust as @ferrlabs/ npm packages. No wait, automerge. registryUrls is a fallback: these deps declare `registry = \"kellnr\"`, which the cargo manager resolves from `.cargo/config.toml` relative to the repo root — but that file lives in each repo's `api/` subdirectory and is not discovered, so the dep would be skipped as `unknown-registry`. In practice the runner supplies CARGO_REGISTRIES_KELLNR_INDEX via RENOVATE_CUSTOM_ENV_VARIABLES, which the extractor reads first (getCargoIndexEnv); registryUrls here covers the case where that env is missing. Note that neither is sufficient on its own: the crate datasource refuses every non-crates.io registry unless allowCustomCrateRegistries=true, which is a global-only option set as RENOVATE_ALLOW_CUSTOM_CRATE_REGISTRIES in renovate.yml. Auth comes from the crates.ferrlabs.com hostRule there, which must use hostType `crate` (the datasource id) — `cargo` is the manager id and matches no hostRule.",
      "matchManagers": [
        "cargo"
      ],
      "matchDepNames": [
        "/^ferrlabs-/"
      ],
      "registryUrls": [
        "sparse+https://crates.ferrlabs.com/api/v1/crates/"
      ],
      "schedule": [
        "* * * * *"
      ],
      "minimumReleaseAge": "0",
      "internalChecksFilter": "none",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "FerrLabs Cargo crates"
    },
    {
      "description": "Third-party npm — quarantine for 3 days after release before opening PR, then auto-merge patch/minor. Release age is the only gate: this rule used to carry `matchMergeConfidence`, which is not a real Renovate option (the real one is `matchConfidence`) and therefore matched nothing, so the confidence gate never applied. Rather than adopt `matchConfidence` — which needs a Mend API key and reports `neutral` without one, silently disabling npm automerge everywhere — the quarantine is raised from 1 to 3 days, which is where most malicious publishes are detected and yanked. npm is deliberately stricter than the Cargo rule below: it is the ecosystem where these attacks actually land.",
      "matchManagers": [
        "npm"
      ],
      "matchPackageNames": [
        "!/^@ferrlabs\\//",
        "!/^@ferrflow\\//",
        "!ferrflow"
      ],
      "matchUpdateTypes": [
        "patch",
        "minor"
      ],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash"
    },
    {
      "description": "Third-party Cargo — wait 1 day after release before opening PR (no merge confidence on crates.io, so this is the main safety gate)",
      "matchManagers": [
        "cargo"
      ],
      "matchDepNames": [
        "!/^ferrlabs-/"
      ],
      "matchUpdateTypes": [
        "patch",
        "minor"
      ],
      "minimumReleaseAge": "1 day",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash"
    },
    {
      "description": "GitHub Actions — wait 3 days after release (action authors often re-tag), grouped + auto-merge weekly",
      "matchManagers": [
        "github-actions"
      ],
      "schedule": [
        "before 6am on monday"
      ],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "GitHub Actions"
    },
    {
      "description": "FerrLabs/.github reusable workflows: no delay, no waiting for Monday. The previous rule waits 3 days because third-party authors re-tag after publishing; that risk does not exist on our own repositories, where we control both the content and the SHA. Without this exception a change in FerrLabs/.github takes up to four days to reach consumers (Monday schedule plus 3 days of age), which blocks any coordinated switchover. `FerrLabs/.github` is named explicitly because a minimatch glob does not match a segment starting with a dot.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["FerrLabs/.github"],
      "schedule": ["at any time"],
      "minimumReleaseAge": "0",
      "internalChecksFilter": "none",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "FerrLabs actions"
    },
    {
      "description": "Every other FerrLabs action, the ferrflow action above all: grouped and taken weekly. These do not need to arrive within the hour, and taking each release the moment it landed was the main source of digest churn. Every commit here changes this repository's digest, 26 repositories pin that digest, so one release fanned out into as many pull requests. In the week before this rule, 12 of the 16 commits here were ferrflow action bumps. Consumers of FerrLabs/.github itself keep the immediate cadence above, which is what that exception exists for.",
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["FerrLabs/**", "!FerrLabs/.github"],
      "schedule": ["before 6am on monday"],
      "minimumReleaseAge": "0",
      "internalChecksFilter": "none",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "FerrLabs actions (weekly)"
    },
    {
      "description": "Dockerfile base images — wait 3 days, grouped + auto-merge weekly",
      "matchManagers": [
        "dockerfile"
      ],
      "schedule": [
        "before 6am on monday"
      ],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash",
      "groupName": "Docker images"
    },
    {
      "description": "Kubernetes infra (Flux HelmReleases, Helm charts, manifest image tags) — auto-merge patch+minor after the 1-day quarantine. Majors stay manual (rule below).",
      "matchManagers": [
        "flux",
        "helmv3",
        "helm-values",
        "kubernetes"
      ],
      "matchUpdateTypes": [
        "patch",
        "minor"
      ],
      "minimumReleaseAge": "1 day",
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash"
    },
    {
      "description": "Major updates — always manual",
      "matchUpdateTypes": [
        "major"
      ],
      "automerge": false
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "description": "FerrLabs Kit crates pinned via git rev = ... in Cargo.toml. Tracks the HEAD of `main` via the git-refs datasource — Kit publishes per-crate tags (ferrlabs-types-v0.4.0 etc.), not a single repo-wide semver tag, so github-tags doesn't fit. git-refs returns the SHA of refs/heads/main and Renovate bumps the rev= to it.",
      "managerFilePatterns": [
        "/(^|/)Cargo\\.toml$/"
      ],
      "matchStrings": [
        "ferrlabs-[a-z\\-]+\\s*=\\s*\\{\\s*git\\s*=\\s*\"https://github.com/FerrLabs/Kit\\.git\"\\s*,\\s*rev\\s*=\\s*\"(?<currentDigest>[a-f0-9]+)\"\\s*\\}"
      ],
      "currentValueTemplate": "main",
      "depNameTemplate": "FerrLabs/Kit",
      "packageNameTemplate": "https://github.com/FerrLabs/Kit",
      "datasourceTemplate": "git-refs"
    }
  ]
}