{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:recommended",
":semanticCommits",
":disableDependencyDashboard",
"gitlab>phpboyscout/cicd"
],
"labels": ["dependencies"],
"rangeStrategy": "bump",
"prCreation": "immediate",
"dependencyDashboard": false,
"automerge": true,
"automergeType": "pr",
"automergeStrategy": "rebase",
"packageRules": [
{
"description": "Auto-merge patch + minor for trusted ecosystems; majors require human review",
"matchUpdateTypes": ["patch", "minor"],
"automerge": true
},
{
"description": "Major bumps land as draft MRs for review — same policy go-tool-base uses",
"matchUpdateTypes": ["major"],
"automerge": false,
"draftPR": true
},
{
"description": "Cargo (Rust) updates land grouped on Mondays to keep Cargo.lock churn low",
"matchManagers": ["cargo"],
"schedule": ["before 9am on monday"],
"groupName": "cargo-weekly"
},
{
"description": "GitLab CI image bumps grouped similarly",
"matchManagers": ["gitlabci"],
"schedule": ["before 9am on monday"],
"groupName": "gitlab-ci-weekly"
},
{
"description": "Disable renovate for the hash-pinned Python docs toolchain — Renovate bumps the version line but cannot regenerate the SHA-256 hashes that `pip install --require-hashes` enforces, leaving CI broken. Bumps to requirements-lock.txt are handled manually via the recipe in the file's own header.",
"matchManagers": ["pip_requirements"],
"enabled": false
},
{
"description": "rust-toolchain.toml is pinned to an exact rustc so trybuild .stderr snapshots stay stable. A bump re-renders those diagnostics, so it must be reviewed (and the snapshots re-blessed) — never auto-merged. Land as a draft MR. This rule follows the patch/minor automerge rule so it wins for the toolchain dep.",
"matchManagers": ["custom.regex"],
"matchDepNames": ["rust"],
"automerge": false,
"draftPR": true,
"labels": ["dependencies", "toolchain"]
}
],
"customManagers": [
{
"description": "Bump the pinned rustc in rust-toolchain.toml. Renovate has no first-class manager for this file, so match the `channel = \"x.y.z\"` line and track rust-lang/rust stable releases.",
"customType": "regex",
"managerFilePatterns": ["/(^|/)rust-toolchain\\.toml$/"],
"matchStrings": ["channel\\s*=\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""],
"depNameTemplate": "rust",
"packageNameTemplate": "rust-lang/rust",
"datasourceTemplate": "github-releases",
"extractVersionTemplate": "^(?<version>\\d+\\.\\d+\\.\\d+)$"
}
],
"vulnerabilityAlerts": {
"enabled": true,
"automerge": true,
"labels": ["security"]
}
}