diff --git a/renovate.json5 b/renovate.json5 index 510820e4..20e92e35 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -1,56 +1,38 @@ { - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "description": "Custom Renovate configuration", - "extends": [ - // Custom Manager Presets (https://docs.renovatebot.com/presets-customManagers/) - "customManagers:githubActionsVersions", // manages _VERSION variables in GitHub Action workflows - - // Default Presets (https://docs.renovatebot.com/presets-default/) - ":approveMajorUpdates", // major dependency updates need to be approved via dashboard before PR is created + $schema: "https://docs.renovatebot.com/renovate-schema.json", + description: "Custom Renovate configuration", + extends: [ + "customManagers:githubActionsVersions", + ":approveMajorUpdates", ":assignAndReview(devtobi)", ":automergePatch", - ":disableRateLimiting", // allows unlimited creation of PRs - ":enableVulnerabilityAlertsWithLabel(security)", // custom label for security PRs created by Renovatebot - ":label(dependency)", // custom label for PRs created by Renovatebot - ":npm", // updating package.json and package-lock.json - ":pinAllExceptPeerDependencies", // do version pinning except for peer dependencies - ":rebaseStalePrs", // rebase Renovate PR branched when base branch is updated - ":semanticCommits", // enabled semantic commits in PR titles - ":separateMultipleMajorReleases", // separate major updates of dependencies into separate PRs - ":timezone(Europe/Berlin)", // sets correct timezone for schedule based operations - - // Full Config Presets (https://docs.renovatebot.com/presets-config/) - "config:best-practices", // enables best practices by the Renovate team - - // Helper Presets (https://docs.renovatebot.com/presets-helpers/) - "helpers:pinGitHubActionDigestsToSemver", // enabled pinning the action digest with a semantic version comment - - // npm Presets (https://docs.renovatebot.com/presets-npm/) - "npm:unpublishSafe", // used to make sure updates are only done after the npm package is "stable" (at least for 3 days) - - // Schedule presets (https://docs.renovatebot.com/presets-schedule/) - "schedule:monthly", // Renovatebot will search weekly for available dependency updates - - // Security presets (https://docs.renovatebot.com/presets-security/) - "security:openssf-scorecard" // show OpenSSF badge on pull requests to evaluate security health metrics for dependencies + ":disableRateLimiting", + ":enableVulnerabilityAlertsWithLabel(security)", + ":label(dependency)", + ":npm", + ":pinAllExceptPeerDependencies", + ":rebaseStalePrs", + ":semanticCommits", + ":separateMultipleMajorReleases", + ":timezone(Europe/Berlin)", + "config:best-practices", + "helpers:pinGitHubActionDigestsToSemver", + "security:minimumReleaseAgeNpm", + "schedule:monthly", + "security:openssf-scorecard", ], - "packageRules": [ + packageRules: [ { - "description": "Disable automerge for patch-level updates when pre-release version", - "matchUpdateTypes": ["patch"], - "matchCurrentVersion": "/^0\\./", - "automerge": false + description: "Disable automerge for patch-level updates when pre-release version", + matchUpdateTypes: ["patch"], + matchCurrentVersion: "/^0\\./", + automerge: false, }, { - "groupName": "PrimeVue packages", - "groupSlug": "primevue", - "matchDatasources": [ - "npm" - ], - "matchPackageNames": [ - "primevue", - "@primevue/*" - ] - } - ] + groupName: "PrimeVue packages", + groupSlug: "primevue", + matchDatasources: ["npm"], + matchPackageNames: ["primevue", "@primevue/*"], + }, + ], }