calendula/renovate.json5

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",

  extends: [
    "config:recommended",
    // chore(deps): … — match the repo's conventional-commit style.
    ":semanticCommits",
  ],

  // `config:recommended` brings in mergeConfidence:age-confidence-badges, whose
  // Age column is a Mend badge. Mend's Merge Confidence index only covers Maven
  // Central: org.jetbrains.kotlin, junit, truth, turbine et al resolve, but
  // every androidx/compose artifact lives on Google's Maven repo and comes back
  // as a grey UNKNOWN — i.e. most of this project. Renovate already knows the
  // real answer, since it derives release timestamps itself for the
  // minimumReleaseAge rules below (Google Maven serves `last-modified` on its
  // POMs), so take the age from there and leave Mend to the Confidence column,
  // which still carries signal for the Maven Central half.
  prBodyDefinitions: {
    Age: "{{#if releaseTimestamp}}{{{newVersionAgeInDays}}} d{{else}}unknown{{/if}}",
  },
  // Default heading links to the Merge Confidence docs; this column is ours now.
  prBodyHeadingDefinitions: {
    Age: "Age",
  },

  // No automerge: a dependency bump goes through the same review (and, for
  // anything touching the build, the same on-device check) as a feature
  // before it can ride a release — see docs/RELEASING.md and the
  // "hold release for approval" rule.
  automerge: false,

  // One reviewable surface; the dashboard issue lists everything pending.
  dependencyDashboard: true,

  // The cooling-off periods below are advisory, not a gate: "none" turns off
  // filtering on the minimumReleaseAge check, so the PR is opened at the
  // highest version straight away and merging early stays a judgement call.
  // (Renovate's default here is "strict", which suppresses the PR entirely
  // until the release has aged in.) A still-young release carries a pending
  // `renovate/stability-days` check so it's visible which side of the line
  // it's on; with automerge off, nothing acts on that check by itself.
  internalChecksFilter: "none",

  labels: ["dependencies"],
  prConcurrentLimit: 5,
  prHourlyLimit: 0,

  // Cadence is owned by the Gitea Actions cron (.gitea/workflows/renovate.yml,
  // Mondays) — no internal `schedule` here, so the two don't double-gate and
  // silently skip a run.

  // Gitea Actions workflows live under .gitea/workflows, not .github — extend
  // the github-actions manager (same syntax) to watch them too.
  "github-actions": {
    fileMatch: ["^\\.gitea/workflows/[^/]+\\.ya?ml$"],
  },

  packageRules: [
    // Cooling-off period, scaled by blast radius: how long a release should
    // have been out (and un-yanked, un-hotfixed) before it's considered
    // settled. Advisory only — see `internalChecksFilter` above.
    {
      matchUpdateTypes: ["major"],
      minimumReleaseAge: "30 days",
    },
    {
      matchUpdateTypes: ["minor"],
      minimumReleaseAge: "20 days",
    },
    {
      matchUpdateTypes: ["patch", "digest", "pin", "rollback"],
      minimumReleaseAge: "10 days",
    },
    // material3 is deliberately pinned to the 1.5 *alpha* line for the
    // Expressive APIs (see gradle/libs.versions.toml). Follow the alpha train
    // but keep it in its own PR, reviewed in isolation; revisit the pin when
    // 1.5.0 stable lands.
    {
      matchPackageNames: ["androidx.compose.material3:material3"],
      ignoreUnstable: false,
      groupName: "material3 (alpha)",
    },
    // Test-only deps: group into one low-noise PR.
    {
      matchPackageNames: [
        "org.junit.jupiter:**",
        "org.junit.platform:**",
        "com.google.truth:**",
        "app.cash.turbine:**",
        "androidx.test:**",
        "androidx.test.espresso:**",
        "androidx.test.ext:**",
      ],
      groupName: "test dependencies",
    },
    // Last word on the PR table. The merge-confidence preset sets prBodyColumns
    // from inside a packageRule of its own, and only for the datasources Mend
    // supports — so a plain top-level prBodyColumns would lose to it for maven
    // deps, and the Gradle wrapper / Actions / container bumps would keep the
    // default columns and show no age at all. A rule declared after it wins,
    // and gives every PR the same table.
    {
      matchPackageNames: ["*"],
      prBodyColumns: ["Package", "Type", "Change", "Age", "Confidence"],
    },
  ],
}