renovate-config/examples/renovate-security-hardened.json at main · miccy/renovate-config · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "description": "🛡️ Security-hardened: Extended stability period, no automerge for production deps, Shai-Hulud package warnings.",
  "extends": [
    "github>miccy/renovate-config"
  ],
  "stabilityDays": 7,
  "minimumReleaseAge": "7 days",
  "packageRules": [
    {
      "description": "Production dependencies: Never automerge",
      "matchDepTypes": ["dependencies", "peerDependencies", "optionalDependencies"],
      "automerge": false
    },
    {
      "description": "Dev dependencies: Automerge only trusted packages",
      "matchDepTypes": ["devDependencies"],
      "automerge": false
    },
    {
      "description": "Trusted dev tools: Allow automerge",
      "matchDepTypes": ["devDependencies"],
      "matchPackagePatterns": [
        "^@biomejs/",
        "^@types/",
        "^typescript$",
        "^vitest",
        "^@vitest/",
        "^prettier$",
        "^eslint$"
      ],
      "automerge": true
    }
  ]
}