From 819610210c507026f58028973b042ba2d9b1bcb4 Mon Sep 17 00:00:00 2001
From: Calvin Bascom <calvin.bascom@luxor.tech>
Date: Tue, 13 Oct 2026 12:54:23 -0400
Subject: [PATCH] Add Renovate config following the jardinero model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set up dependency updates before the repo goes public, mirroring the
conventions of the public LuxorLabs/jardinero repo: weekend schedule,
14-day release-age gate, majors parked on the dependency dashboard,
lockfile maintenance for uv.lock, and security-labeled vulnerability
PRs. Adapted to this repo's toolchain — the grpcio/grpcio-tools/protobuf
stack and pytest/pytest-asyncio are grouped since each pair is
version-coupled.

The github-actions manager is disabled: SHA pins are managed by hand so
a digest-bump PR can't run CI under a new SHA before anyone reviews it,
matching the repo's "require actions pinned to a full-length SHA"
policy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 renovate.json | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..063723d
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,64 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "enabled": true,
+  "extends": ["config:recommended"],
+  "schedule": ["every weekend"],
+  "labels": ["dependencies", "renovate"],
+  "configMigration": true,
+  "rebaseWhen": "conflicted",
+  "lockFileMaintenance": {
+    "description": [
+      "Refresh uv.lock on its own schedule. A refresh is only true of the tree it resolved against, so every merge to main leaves this branch describing a pyproject that has moved; rebasing on the base branch regenerates it, keeping its green check a statement about the merge someone is actually about to make.",
+      "No age gate on the refresh itself: uv resolves the transitive versions here, and it is the only side that sees them."
+    ],
+    "enabled": true,
+    "schedule": ["every weekend"],
+    "minimumReleaseAge": null,
+    "rebaseWhen": "behind-base-branch"
+  },
+  "prConcurrentLimit": 5,
+  "minimumReleaseAge": "14 days",
+  "internalChecksFilter": "strict",
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "labels": ["security"]
+  },
+  "packageRules": [
+    {
+      "description": "A major needs a proper read of its changelog, which rarely happens the week it lands. Park it on the dashboard so it stops holding a concurrency slot, and tick it there when someone is ready to do that work.",
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "A lock file refresh carries no update anyone is waiting on, so it takes a concurrency slot only when a real update does not need it.",
+      "matchUpdateTypes": ["lockFileMaintenance"],
+      "prPriority": -1
+    },
+    {
+      "description": "Manage github-actions SHA pins manually; a digest-bump PR would run CI with the new SHA before anyone reviews it.",
+      "matchManagers": ["github-actions"],
+      "enabled": false
+    },
+    {
+      "description": "Batch non-major updates into one PR to keep the weekend run quiet.",
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "non-major dependencies"
+    },
+    {
+      "description": "A 0.x release makes no compatibility promise, so a minor or a patch there can break like a major does. Each gets its own PR rather than riding in a batch, where one broken member holds up the safe ones.",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchCurrentVersion": "<1.0.0",
+      "groupName": null
+    },
+    {
+      "description": "grpcio, grpcio-tools, and protobuf are version-coupled (the generated bindings target a protobuf runtime), so they move together.",
+      "groupName": "grpc + protobuf",
+      "matchPackageNames": ["grpcio", "grpcio-tools", "protobuf"]
+    },
+    {
+      "description": "pytest and pytest-asyncio move together; the plugin tracks the pytest it supports.",
+      "groupName": "pytest",
+      "matchPackageNames": ["pytest", "pytest-asyncio"]
+    }
+  ]
+}