default.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "description": "Org-wide Renovate preset. Repos extend with: github>monumental-archive/.github#vX.Y.Z",
  "extends": ["config:best-practices", ":dependencyDashboard"],
  "minimumReleaseAge": "7 days",
  "commitMessageAction": "update",
  "commitMessageTopic": "{{depName}}",
  "commitMessageExtra": "to {{newValue}}",
  "semanticCommitType": "chore",
  "semanticCommitScope": "deps",
  "packageRules": [
    {
      "description": "THE OWNED TEMPLATE (#576). Every permanent commit subject a machine mints in this org is composed from the five commitMessage/semanticCommit fields above and nowhere else. They are set EXPLICITLY, including where the value equals Renovate's own default: lint:subject-budget simulates this template to prove each declared dependency mints a subject that fits, and a simulation reading an upstream default it cannot see is the agreeing-by-memory failure #576 exists to kill. An absent field is a hard error there, never a fallback. The topic is restated as a catch-all rule here as well as at the top level because the managers carry their own defaults (`dependency {{depName}}`, `{{depName}} action`, `{{depName}} digest` — three shapes, none ours, costing eleven columns to say nothing), the documentation routes manager-specific topics through packageRules, and a rule unambiguously beats a manager default. The per-dependency rules below override this one in turn, later-wins. Each lists the depName BOTH with and without its mise backend prefix, because Renovate renders depName with it (`update dependency github:monumental-archive/stele …`, #574) while selecting on the stripped packageName (the same PR came out scoped `chore(canon)` from `monumental-archive/**`); a pattern that matches nothing costs nothing, and one of the two is right.",
      "matchPackageNames": ["*"],
      "commitMessageTopic": "{{depName}}"
    },
    {
      "description": "gomod keeps `fix`, restated rather than inherited. The top-level semanticCommitType above now owns every manager, and Renovate's gomod default is `fix` — measured, not read: stele's #179 and #180 are `fix(deps): update module …`. Letting the top-level `chore` swallow that would move Go dependency bumps from Fixed to Dependencies in the release notes and out of the version decision, which is a release-semantics change and not this issue's to make. Explicit here, behaviour unchanged.",
      "matchManagers": ["gomod"],
      "semanticCommitType": "fix"
    },
    {
      "description": "cargo mints `fix`, because a Cargo.lock change is a change to the bytes the released artifact ships and a `chore` derives no version at all (#558). Measured on release-lab 2026-08-19: three merged commits since v0.25.1, all chores, and two release runs both concluding `nothing to release: no version-bumping commits since 0.25.1`. That is the whole hole — the dependency track can detect an advisory (blast radius), record the decision (VEX) and block an undecided release, but the way OUT of that state was a release no commit type ever triggered. The derivation refusing a chore-only range is correct and is not what changes here; the commits are classified honestly instead, so the release is derivable FROM history rather than forced over it. Wholesale per manager, no dev-dependency carve-out: gomod is already `fix` wholesale, and Renovate cannot evaluate `does this dependency reach the artifact` at commit-minting time — the manager is the honest proxy it can, and this proxy errs only toward an unnecessary patch release, which is cheap where a missed delivery is not. Explicit rather than inherited from the top-level `chore`, the gomod rule's reason: lint:subject-budget resolves the prefix from these rules, and it may not read a value no one wrote. Subjects narrow by two columns here (`fix(deps):` against `chore(deps):`), so nothing the budget already passes can widen.",
      "matchManagers": ["cargo"],
      "semanticCommitType": "fix"
    },
    {
      "description": "npm mints `fix`, on the same rule as cargo above and for the same reason: the wasm-npm class publishes a package, so a package.json or lockfile change is a change to shipped bytes, and `chore` would leave it with no path to a release (#558). This rule matches nothing today — measured 2026-08-20, none of the seven local org checkouts tracks a package.json, while three track a Cargo.toml — because the class generates its manifest rather than tracking one. That is deliberate, not oversight: a rule that matches nothing costs nothing, the principle this preset already records for the mise-backend depName spellings, and the classification is a property of the MANAGER decided once here rather than something a human must remember to apply when the first tracked manifest arrives. The alternative is a preset that is silently wrong on the day the class lands and correct only if someone notices.",
      "matchManagers": ["npm"],
      "semanticCommitType": "fix"
    },
    {
      "description": "26 as minted; 1.58.10 spent the last of VERSION_GROWTH's three columns, so every canon bump in every repo minted at 73 (#826).",
      "matchPackageNames": ["monumental-archive/.github"],
      "commitMessageTopic": "canon"
    },
    {
      "description": "46 characters as minted, 17 past the budget.",
      "matchPackageNames": [
        "aqua:editorconfig-checker/editorconfig-checker",
        "editorconfig-checker/editorconfig-checker"
      ],
      "commitMessageTopic": "editorconfig-checker"
    },
    {
      "description": "37 as minted, 9 past.",
      "matchPackageNames": [
        "github:obi1kenobi/cargo-semver-checks",
        "obi1kenobi/cargo-semver-checks"
      ],
      "commitMessageTopic": "cargo-semver-checks"
    },
    {
      "description": "32 as minted, 3 past.",
      "matchPackageNames": ["actions/dependency-review-action"],
      "commitMessageTopic": "dependency-review-action"
    },
    {
      "description": "31 as minted, 2 past.",
      "matchPackageNames": ["actions/create-github-app-token"],
      "commitMessageTopic": "create-github-app-token"
    },
    {
      "description": "31 as minted, 3 past — the dependency whose stuck pull request (#574) opened this.",
      "matchPackageNames": [
        "github:monumental-archive/stele",
        "monumental-archive/stele"
      ],
      "commitMessageTopic": "monumental-archive/stele"
    },
    {
      "description": "109 as minted, 37 past — a 34-character Go pseudo-version underneath, so the name must be tiny; jcs is the algorithm's own name (JSON Canonicalization Scheme).",
      "matchPackageNames": ["github.com/cyberphone/json-canonicalization"],
      "commitMessageTopic": "jcs"
    },
    {
      "description": "92 as minted, 20 past — pseudo-versioned like jcs; pkcs7 is the standard's name.",
      "matchPackageNames": ["github.com/digitorus/pkcs7"],
      "commitMessageTopic": "pkcs7"
    },
    {
      "description": "91 as minted, 19 past.",
      "matchPackageNames": [
        "github.com/secure-systems-lab/go-securesystemslib"
      ],
      "commitMessageTopic": "go-securesystemslib"
    },
    {
      "description": "86 as minted, 14 past.",
      "matchPackageNames": ["github.com/google/certificate-transparency-go"],
      "commitMessageTopic": "certificate-transparency-go"
    },
    {
      "description": "80 as minted, 8 past.",
      "matchPackageNames": ["github.com/google/go-containerregistry"],
      "commitMessageTopic": "go-containerregistry"
    },
    {
      "description": "78 as minted, 6 past.",
      "matchPackageNames": [
        "go:golang.org/x/vuln/cmd/govulncheck",
        "golang.org/x/vuln/cmd/govulncheck"
      ],
      "commitMessageTopic": "govulncheck"
    },
    {
      "description": "75 as minted, 3 past.",
      "matchPackageNames": ["github.com/transparency-dev/merkle"],
      "commitMessageTopic": "merkle"
    },
    {
      "description": "75 as minted, 3 past.",
      "matchPackageNames": ["github.com/sigstore/protobuf-specs"],
      "commitMessageTopic": "protobuf-specs"
    },
    {
      "description": "73 columns as the ADVISORY subject, 1 past \u2014 measured under #686's model, where the suffix spends the pull-request-number allowance rather than charging beside it. The ordinary subject fits; this rule exists for the advisory one, which is the pull request in the org it would hurt most to have wedged.",
      "matchPackageNames": ["github.com/sigstore/sigstore-go"],
      "commitMessageTopic": "sigstore-go"
    },
    {
      "description": "73 columns as the ADVISORY subject, 1 past \u2014 the same measurement and the same reason as sigstore-go above. The major suffix is kept: `go-toml` and `go-toml/v2` are different modules and a subject that cannot tell them apart is worse than a long one.",
      "matchPackageNames": ["github.com/pelletier/go-toml/v2"],
      "commitMessageTopic": "go-toml/v2"
    },
    {
      "description": "73 as minted, 1 past.",
      "matchPackageNames": ["github.com/Masterminds/semver/v3"],
      "commitMessageTopic": "semver"
    },
    {
      "description": "Routine updates merge themselves once aged and green; majors always get a human.",
      "matchUpdateTypes": ["patch", "minor", "pin", "digest", "pinDigest"],
      "automerge": true
    },
    {
      "description": "First-party skips the age gate, org-wide: it models third-party supply-chain risk, and applied to our own repos — gated by our own CI — it only guarantees every consumer runs week-stale first-party code (#133, the v0.16.1 VSA failure; the signer digest sat in the same queue). The chore(canon) scope is the other half of a two-config contract (#227): the release notes convention leaves it unmapped and the silent-types rule keeps it out of the version decision, so a canon-pin bump never justifies a release — in the canon itself that ends the self-bump release loop, and in consumers it stops a lint-config update from burning a version number on an artifact that did not change. The age gate is only half the queue (#290 finding 4): prHourlyLimit/prConcurrentLimit are top-level-only, so Renovate's default throttle (2 PRs/hour) applies to first-party too, and on 2026-08-12 the canon bump AND the signer digest sat rate-limited 12+ hours behind thirty third-party PRs. prPriority puts first-party at the front of every queue slot, and groupName collapses the canon bump and signer digest into one PR consuming one slot — first-party effectively never queues, while the global throttle (worth keeping: the 7-day age gate releases third-party in bursts) stays untouched.",
      "matchPackageNames": ["monumental-archive/**"],
      "minimumReleaseAge": "0 days",
      "prPriority": 10,
      "groupName": "first-party canon",
      "semanticCommitType": "chore",
      "semanticCommitScope": "canon"
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "description": "lefthook remote hooks pin a canon tag; lefthook.yml has no native manager for the ref line (#133).",
      "managerFilePatterns": ["/(^|/)lefthook\\.yml$/"],
      "matchStrings": [
        "git_url: https://github\\.com/monumental-archive/\\.github\\n\\s*ref: (?<currentValue>v[0-9][\\w.+-]*)"
      ],
      "depNameTemplate": "monumental-archive/.github",
      "datasourceTemplate": "github-tags"
    },
    {
      "customType": "regex",
      "description": "The shared-preset reference pins a canon tag; extends: has no native manager for the #tag suffix (#133).",
      "managerFilePatterns": ["/(^|/)renovate\\.json$/"],
      "matchStrings": [
        "github>monumental-archive/\\.github#(?<currentValue>v[0-9][\\w.+-]*)"
      ],
      "depNameTemplate": "monumental-archive/.github",
      "datasourceTemplate": "github-tags"
    }
  ],
  "lockFileMaintenance": {
    "description": "The cadence at which shipped crates may go stale, CHOSEN rather than inherited (#667). The value equals Renovate's own default \u2014 measured at renovatebot/renovate@b7f19dc9, `schedule: ['before 4am on monday']`, and observed firing 2026-08-17 02:07 \u2014 and it is written out for the reason this preset gives for the subject template above: a value the org leans on and did not write is a value nobody can see change underneath it. It is leaned on hard, because this branch is the ONLY path by which an in-range or transitive crate moves in this org \u2014 measured on release-lab, whose direct crates are ranges (`mimalloc 0.1`, `wasm-bindgen 0.2`) or exact pins (`pgrx =0.19.2`), so Renovate has never raised a crate update pull request there and every advisory reachable only through `Cargo.lock` waits for Monday. Weekly is defensible ONLY because vulnerabilityAlerts below exists: an advisory does not wait for this schedule, it escapes it. Tightening the cadence as a SUBSTITUTE for that was rejected on #667 \u2014 a daily race against an event is still a race. The option is `mergeable: true` upstream, so the fields not written here (recreateWhen, branchTopic, commitMessageAction, prBodyDefinitions) survive from Renovate's default; the three below are the org's.",
    "enabled": true,
    "automerge": true,
    "schedule": ["before 4am on monday"]
  },
  "vulnerabilityAlerts": {
    "description": "Advisories jump the queue, declared rather than inherited, and `osvVulnerabilityAlerts` beside this block is the same decision \u2014 OSV is the only source that sees a RustSec advisory GitHub has not mirrored, and it is gated on itself alone (`extract-update.ts`), independent of this block's `enabled` (#667). MEASURED at renovatebot/renovate@b7f19dc9, not read from the documentation, which states neither answer: the upstream default for this block ALREADY carries `minimumReleaseAge: null`, `schedule: []` and `prCreation: 'immediate'`, and `mergeChildConfig` is a plain `{...parent, ...child}` spread with no null-skipping, so an advisory branch does escape the 7-day age gate above with no override needed. Every field is written out anyway, because the option is `mergeable: true` upstream \u2014 a partly declared block silently inherits the rest, the agreeing-from-memory state #576 exists to kill \u2014 and because a bypass the lock cadence below depends on for its own defensibility may not be invisible. `groupName: null` keeps an advisory out of the first-party group so it can merge alone; `dependencyDashboardApproval: false` stops it waiting for a human tick; `vulnerabilityFixStrategy: 'lowest'` takes the earliest version that clears the advisory, the smallest jump the waived caution has to buy; `rangeStrategy: 'update-lockfile'` is what makes an in-range fix a lockfile-only change \u2014 cargo honours it (`cargo/range.ts`), and its `updateLockedDependency` answering `unsupported` is not a failure there but the hand-off to `cargo update --precise`. `branchTopic` is the one field deliberately left inherited: it is a template over Renovate's internal variable names, not an org decision, and pinning it would freeze an identifier this org does not own. `commitMessageSuffix` is Renovate's own value restated \u2014 it is in force whether or not this preset writes it, and writing it is what makes visible that lint:subject-budget models no suffix at all: measured on the canon, 20 of 49 declared dependencies would mint an advisory subject past the budget's literal 72 columns, of which committed's wrap-aware gate rejects only the widest (79 columns passes, 91 fails). Filed, not fixed here. THE RESIDUAL, recorded because a config believed to cover more than it does is worse than none: none of this reaches a crate unless a Cargo.toml declares it. An advisory in a transitive crate \u2014 where #667 measured the CVE surface actually lives \u2014 has no extracted dependency, so the OSV path generates no rule for it and the Dependabot path lands on `remediationNotPossible`. audit:blast-radius remains the detector and lock file maintenance above the delivery for that set.",
    "enabled": true,
    "minimumReleaseAge": null,
    "schedule": [],
    "prCreation": "immediate",
    "dependencyDashboardApproval": false,
    "groupName": null,
    "rangeStrategy": "update-lockfile",
    "vulnerabilityFixStrategy": "lowest",
    "commitMessageSuffix": "[SECURITY]"
  },
  "osvVulnerabilityAlerts": true,
  "commitBody": "Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>"
}