{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",

  extends: [
    "config:recommended",
    // chore(deps): … — match the repo's conventional-commit style.
    ":semanticCommits",
    // Adds the Age / Adoption / Passing / Confidence columns to the PR table
    // (Mend's Merge Confidence badges; free, no token — Renovate only embeds
    // the badge URLs and the browser loads them when the PR is viewed).
    // Covers the maven datasource, i.e. everything in libs.versions.toml;
    // the github-actions datasource has no badges, so those PRs stay plain.
    "mergeConfidence:all-badges",
  ],

  // No automerge: a dependency bump goes through the same review (and, for
  // anything touching the build, the same on-device check) as a feature
  // before it can ride a release — see docs/RELEASING.md and the
  // "hold release for approval" rule.
  automerge: false,

  // One reviewable surface; the dashboard issue lists everything pending.
  dependencyDashboard: true,

  // The cooling-off periods below are advisory, not a gate: "none" turns off
  // filtering on the minimumReleaseAge check, so the PR is opened at the
  // highest version straight away and merging early stays a judgement call.
  // (Renovate's default here is "strict", which suppresses the PR entirely
  // until the release has aged in.) A still-young release carries a pending
  // `renovate/stability-days` check so it's visible which side of the line
  // it's on; with automerge off, nothing acts on that check by itself.
  internalChecksFilter: "none",

  labels: ["dependencies"],
  prConcurrentLimit: 5,
  prHourlyLimit: 0,

  // Cadence is owned by the Gitea Actions cron (.gitea/workflows/renovate.yml,
  // Mondays) — no internal `schedule` here, so the two don't double-gate and
  // silently skip a run.

  // Gitea Actions workflows live under .gitea/workflows, not .github — extend
  // the github-actions manager (same syntax) to watch them too.
  "github-actions": {
    fileMatch: ["^\\.gitea/workflows/[^/]+\\.ya?ml$"],
  },

  packageRules: [
    // Cooling-off period, scaled by blast radius: how long a release should
    // have been out (and un-yanked, un-hotfixed) before it's considered
    // settled. Advisory only — see `internalChecksFilter` above.
    {
      matchUpdateTypes: ["major"],
      minimumReleaseAge: "30 days",
    },
    {
      matchUpdateTypes: ["minor"],
      minimumReleaseAge: "20 days",
    },
    {
      matchUpdateTypes: ["patch", "digest", "pin", "rollback"],
      minimumReleaseAge: "10 days",
    },
    // material3 is deliberately pinned to the 1.5 *alpha* line for the
    // Expressive APIs (see gradle/libs.versions.toml). Follow the alpha train
    // but keep it in its own PR, reviewed in isolation; revisit the pin when
    // 1.5.0 stable lands.
    {
      matchPackageNames: ["androidx.compose.material3:material3"],
      ignoreUnstable: false,
      groupName: "material3 (alpha)",
    },
    // Test-only deps: group into one low-noise PR.
    {
      matchPackageNames: [
        "org.junit.jupiter:**",
        "org.junit.platform:**",
        "com.google.truth:**",
        "app.cash.turbine:**",
        "androidx.test:**",
        "androidx.test.espresso:**",
        "androidx.test.ext:**",
      ],
      groupName: "test dependencies",
    },
  ],
}