renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":semanticCommits",
    ":semanticCommitTypeAll(chore)",
    ":enableVulnerabilityAlertsWithLabel(security)"
  ],
  "schedule": ["before 6am on monday"],
  "timezone": "Europe/Madrid",
  "rangeStrategy": "bump",
  "constraints": {
    "go": "1.25"
  },
  "labels": ["dependencies"],
  "prConcurrentLimit": 5,
  "prHourlyLimit": 0,
  "vulnerabilityAlerts": {
    "labels": ["security", "dependencies"],
    "schedule": ["at any time"]
  },
  "packageRules": [
    {
      "description": "Never auto-bump the go directive in go.mod; the support floor is a deliberate, manually-managed compatibility decision. CI no longer pins a toolchain version — it derives <major>.<minor>.x from this directive and lets setup-go resolve the newest patch — so nothing here needs Renovate to move it",
      "matchManagers": ["gomod"],
      "matchDatasources": ["golang-version"],
      "enabled": false
    },
    {
      "description": "Group all Go minor + patch updates into one PR",
      "matchManagers": ["gomod"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "go-deps (non-major)",
      "automerge": false
    },
    {
      "description": "Group all GitHub Actions updates into one PR",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "groupName": "github-actions",
      "pinDigests": true,
      "automerge": false
    },
    {
      "description": "Major bumps always get their own PR for human review",
      "matchUpdateTypes": ["major"],
      "labels": ["dependencies", "major-bump"],
      "automerge": false
    }
  ],
  "customManagers": [
    {
      "description": "Track the SHA-pinned Go tools installed via `go install ...@<sha> # <version>` in the Makefile",
      "customType": "regex",
      "managerFilePatterns": ["/^Makefile$/"],
      "matchStrings": [
        "go install (?<depName>\\S+?)(?:/cmd/\\S+?)?@(?<currentDigest>[a-f0-9]{40}) # (?<currentValue>v\\S+)"
      ],
      "datasourceTemplate": "go"
    },
    {
      "description": "Track the GOLANGCI_LINT_VERSION pin in ci.yml",
      "customType": "regex",
      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"],
      "matchStrings": [
        "GOLANGCI_LINT_VERSION:\\s*'(?<currentValue>\\S+)'"
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "golangci/golangci-lint"
    }
  ],
  "postUpdateOptions": ["gomodTidy"],
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on the first day of the month"]
  }
}