-
Notifications
You must be signed in to change notification settings - Fork 90
Expand file tree
/
Copy pathrenovate.json
More file actions
99 lines (90 loc) · 3.65 KB
/
renovate.json
File metadata and controls
99 lines (90 loc) · 3.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
// config:recommended gives automerge/grouping primitives without the
// :pinDevDependencies preset that config:best-practices pulls in.
// All dependencies (dev and published) are pinned to exact versions.
// pnpm-lock.yaml provides reproducible installs; pinning in package.json
// additionally prevents surprise version drift if the lockfile is bypassed
// or a consumer installs the package directly.
"extends": [
"config:recommended",
"helpers:pinGitHubActionDigests",
":disableDependencyDashboard"
],
// Pin everything to exact versions — no ^ or ~ ranges anywhere.
"rangeStrategy": "pin",
"semanticCommits": "enabled",
// Batch all non-major updates on Mondays to keep the PR queue manageable.
"schedule": ["before 9am on Monday"],
"packageRules": [
// ── peerDependencies ──────────────────────────────────────────────────
// Never touch peerDependencies automatically; semver ranges are
// intentional contracts between the plugin and its host.
{
"matchDepTypes": ["peerDependencies"],
"enabled": false
},
// ── Root devDependencies: patch + minor ───────────────────────────────
// Safe to automerge; CI validates correctness.
{
"matchManagers": ["npm"],
"matchDepTypes": ["devDependencies"],
"matchUpdateTypes": ["patch", "minor"],
"automerge": true,
"automergeType": "pr",
"labels": ["dependencies"]
},
// ── Root devDependencies: major ───────────────────────────────────────
// Require manual review; majors may have breaking API changes.
{
"matchManagers": ["npm"],
"matchDepTypes": ["devDependencies"],
"matchUpdateTypes": ["major"],
"labels": ["dependencies", "major"],
"automerge": false
},
// ── Published package dependencies ────────────────────────────────────
// Pinned to exact versions for the same reason as devDeps; exact versions
// in published packages give consumers a deterministic dependency graph
// and prevent transitive vulnerability drift.
{
"matchManagers": ["npm"],
"matchDepTypes": ["dependencies"],
"automerge": false,
"labels": ["dependencies"]
},
// ── Tooling groups (reduces PR noise) ────────────────────────────────
{
"groupName": "ESLint",
"matchPackageNames": ["/^eslint/", "/^@eslint/", "/^@typescript-eslint/", "typescript-eslint"]
},
{
"groupName": "TypeScript",
"matchPackageNames": ["/^typescript$/", "/^ts-/", "tslib"]
},
{
"groupName": "Jest",
"matchPackageNames": ["/^jest/", "/^@jest/", "/^babel-jest/", "/^ts-jest/", "jest-environment-jsdom"]
},
{
"groupName": "Rollup",
"matchPackageNames": ["/^rollup/", "/^@rollup/"]
},
{
"groupName": "PostCSS",
"matchPackageNames": ["/^postcss/", "cssnano", "stylelint", "stylelint-order"]
},
{
"groupName": "Commitlint",
"matchPackageNames": ["/^@commitlint/"]
},
{
"groupName": "Release tooling",
"matchPackageNames": ["/^release-it/", "/^@release-it/", "/^@release-it-plugins/", "dotenv-cli"]
},
{
"groupName": "Git hooks",
"matchPackageNames": ["husky", "lint-staged"]
}
]
}