remote-flows/renovate.json at main · remoteoss/remote-flows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "rangeStrategy": "bump",

  "minimumReleaseAge": "7 days",
  "internalChecksFilter": "strict",

  "npmrc": "optional=true\ninclude=optional",

  "postUpdateOptions": ["npmDedupe"],

  "vulnerabilityAlerts": {
    "enabled": true,
    "groupName": null,
    "minimumReleaseAge": "0 days"
  },

  "semanticCommits": "enabled",

  "packageRules": [
    {
      "description": "Enforce 7-day wait for all non-security updates",
      "matchUpdateTypes": ["major", "minor", "patch"],
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Security updates bypass wait time",
      "matchDatasources": ["npm"],
      "vulnerabilityAlerts": {
        "enabled": true
      },
      "rangeStrategy": "bump",
      "minimumReleaseAge": "0 days",
      "semanticCommitType": "fix",
      "semanticCommitScope": "security"
    },
    {
      "description": "DevDependencies always use chore (all update types)",
      "matchDepTypes": ["devDependencies"],
      "semanticCommitType": "chore",
      "semanticCommitScope": "deps-dev",
      "minimumReleaseAge": "7 days"
    },
    {
      "description": "Production major updates trigger minor version bump",
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["major"],
      "minimumReleaseAge": "7 days",
      "semanticCommitType": "feat",
      "semanticCommitScope": "deps"
    },
    {
      "description": "Production minor/patch updates are chores",
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "minimumReleaseAge": "7 days",
      "semanticCommitType": "chore",
      "semanticCommitScope": "deps"
    },
    {
      "description": "Disable automatic Node.js engine updates (handle manually for major releases)",
      "matchManagers": ["npm"],
      "matchDepTypes": ["engines"],
      "matchPackageNames": ["node"],
      "enabled": false
    },
    {
      "description": "Preserve optional dependencies in lockfile",
      "matchPackageNames": ["esbuild", "@esbuild/**"],
      "enabled": true
    }
  ]
}