renovate.json
Rama main · réplica de lectura del repositorio original.
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:best-practices",
"docker:enableMajor",
":separateMajorReleases"
],
"labels": ["dependencies"],
"rangeStrategy": "pin",
"postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
"dependencyDashboardApproval": false,
"timezone": "America/New_York",
"schedule": ["before 6am on monday"],
"prConcurrentLimit": 0,
"prHourlyLimit": 0,
"lockFileMaintenance": {
"enabled": true,
"schedule": ["before 6am on monday"]
},
"vulnerabilityAlerts": {
"enabled": true,
"labels": ["dependencies", "security"],
"schedule": ["at any time"],
"prHourlyLimit": 0,
"prConcurrentLimit": 0
},
"customManagers": [
{
"description": "govulncheck pin in the Security workflow. A go install command has no built-in manager.",
"customType": "regex",
"managerFilePatterns": ["/^\\.github/workflows/security\\.yml$/"],
"matchStrings": ["go install (?<depName>golang\\.org/x/vuln)/cmd/govulncheck@(?<currentValue>v\\S+)"],
"datasourceTemplate": "go"
}
],
"pip-compile": {
"managerFilePatterns": ["/^goopy/internal/ecosystem/requirements\\.txt$/"]
},
"pip_requirements": {
"enabled": false
},
"packageRules": [
{
"description": "Ignore local goopy module (replaced via go.mod replace directive)",
"matchManagers": ["gomod"],
"matchPackageNames": ["github.com/pypx/goopy"],
"enabled": false
},
{
"description": "Ignore our own CI-built deploy images — private GHCR packages consumed as :latest; Renovate can't auth to them (causes 'No docker auth found' warning) and must not digest-pin them",
"matchDatasources": ["docker"],
"matchPackageNames": ["ghcr.io/mattstrayer/pypx/**"],
"enabled": false
},
{
"description": "Catch-all: batch all remaining npm minor/patch into one rolling PR, automerged when CI is green. Specific ecosystem rules below override groupName and automerge. Majors stay individual.",
"matchManagers": ["npm"],
"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
"groupName": "web: misc (non-major)",
"automerge": true
},
{
"description": "Nuxt + Vite move together — nuxt releases track vite compatibility. nuxt-* covers the Nuxt SEO module family (nuxt-site-config, nuxt-og-image, nuxt-ai-ready, ...), whose peer ranges must move with @nuxtjs/seo or the install breaks. vue and vue-router are direct nuxt dependencies: bumping nuxt alone (e.g. 4.6.2 needs vue ^3.5.44) installs a second vue copy, and Nuxt auto-import types then miss the templates (#307).",
"matchManagers": ["npm"],
"matchPackageNames": [
"nuxt",
"nuxt-*",
"vue",
"vue-router",
"@nuxt/**",
"@nuxtjs/**",
"vite",
"@vitejs/**",
"nitropack"
],
"groupName": "web: nuxt + vite",
"automerge": false
},
{
"description": "Vue ecosystem (vue and vue-router move with nuxt, above)",
"matchManagers": ["npm"],
"matchPackageNames": [
"@vue/**",
"@vueuse/**"
],
"groupName": "web: vue",
"automerge": false
},
{
"description": "Tailwind — @tailwindcss/vite is versioned in lockstep with tailwindcss",
"matchManagers": ["npm"],
"matchPackageNames": [
"tailwindcss",
"@tailwindcss/**"
],
"groupName": "web: tailwind",
"automerge": false
},
{
"description": "TypeScript + vue-tsc — vue-tsc tracks TS compiler compatibility",
"matchManagers": ["npm"],
"matchPackageNames": [
"typescript",
"vue-tsc"
],
"groupName": "web: typescript",
"automerge": false
},
{
"description": "Keep typescript on 6.x. TypeScript 7 ships only the native compiler with no JS compiler API (no lib/tsc), so vue-tsc fails with ERR_PACKAGE_PATH_NOT_EXPORTED (#218). The TS 7.0 announcement says Vue projects must wait for the API planned for 7.1. Remove once vue-tsc supports TypeScript 7.",
"matchManagers": ["npm"],
"matchPackageNames": ["typescript"],
"allowedVersions": "<7"
},
{
"description": "oxc tooling — plugin API must stay compatible with the oxlint version (if oxlint-plugin-complexity breaks, pin oxlint to the last working version)",
"matchManagers": ["npm"],
"matchPackageNames": [
"oxlint",
"oxlint-plugin-**",
"oxfmt"
],
"groupName": "web: oxc",
"automerge": false
},
{
"description": "Test tooling (must come after vue/nuxt rules so @vue/test-utils and @nuxt/test-utils land here)",
"matchManagers": ["npm"],
"matchPackageNames": [
"vitest",
"@vitest/**",
"happy-dom",
"@vue/test-utils",
"@nuxt/test-utils"
],
"groupName": "web: testing",
"automerge": false
},
{
"description": "Go dependencies (both api and goopy modules)",
"matchManagers": ["gomod"],
"matchUpdateTypes": ["minor", "patch"],
"groupName": "api: go dependencies"
},
{
"description": "GitHub Actions",
"matchManagers": ["github-actions"],
"groupName": "ci: github actions"
},
{
"description": "Docker images (compose + Dockerfiles)",
"matchManagers": ["dockerfile", "docker-compose"],
"groupName": "infra: docker"
},
{
"description": "Go toolchain moves atomically: go directive in go.mod files + golang base image (must come after the docker rule to pull golang out of the docker group)",
"matchDepNames": ["go", "golang"],
"matchManagers": ["gomod", "dockerfile"],
"groupName": "go toolchain"
},
{
"description": "pnpm moves atomically: the action-setup version in CI + the deploy/pnpm lockfile that web/Dockerfile installs (must come after the npm catch-all and the actions rule to pull pnpm out of those groups). No automerge, as before deploy/pnpm joined the npm catch-all.",
"matchDepNames": ["pnpm"],
"groupName": "pnpm",
"automerge": false
},
{
"description": "Keep the security floors in pnpm-workspace.yaml as >= ranges. A pin would stop them from picking up later patched versions. Lock file maintenance moves the resolved versions. Only the workspace overrides match, so these packages keep rangeStrategy pin elsewhere.",
"matchManagers": ["npm"],
"matchDepTypes": ["pnpm-workspace.overrides"],
"matchPackageNames": ["glob", "minimatch", "node-forge"],
"rangeStrategy": "replace"
},
{
"description": "Automerge non-major test tooling updates",
"matchManagers": ["npm"],
"matchPackageNames": [
"vitest",
"@vitest/**",
"happy-dom",
"@vue/test-utils",
"@nuxt/test-utils"
],
"matchUpdateTypes": ["minor", "patch"],
"automerge": true
},
{
"description": "Automerge patch-level Go dependency updates",
"matchManagers": ["gomod"],
"matchUpdateTypes": ["patch"],
"automerge": true
},
{
"description": "Automerge GitHub Actions minor/patch updates",
"matchManagers": ["github-actions"],
"matchUpdateTypes": ["minor", "patch"],
"automerge": true
}
]
}