chore: Configure Renovate

.github/workflows/update-toolchain.yml

@@ -1,6 +1,6 @@
 on:
   schedule:
-    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC — matches dependabot.yml's cadence
+    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC — same day as Renovate's weekly schedule
   workflow_dispatch: # Manually invoked by user.
 
 name: update-toolchain

renovate.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    "helpers:pinGitHubActionDigests",
+    "schedule:weekly"
+  ],
+  "minimumReleaseAge": "3 days",
+  "packageRules": [
+    {
+      "description": "One PR for all non-major npm updates",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm non-major"
+    },
+    {
+      "description": "One PR for all GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["action"],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "pnpm overrides are security floors for transitive packages, not versions to bump",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["pnpm-workspace.overrides", "pnpm.overrides", "overrides"],
+      "enabled": false
+    },
+    {
+      "description": "Our own packages skip the release-age delay, as in pnpm-workspace.yaml",
+      "matchPackageNames": ["@openshock/**"],
+      "minimumReleaseAge": null
+    },
+    {
+      "description": "The pnpm patch is keyed to an exact SignalR version, so bumps need the patch refreshed by hand",
+      "matchPackageNames": ["@microsoft/signalr"],
+      "groupName": null
+    },
+    {
+      "description": "Node, pnpm and the base image are bumped together by .github/workflows/update-toolchain.yml",
+      "matchFileNames": [".nvmrc", "Dockerfile", "package.json"],
+      "matchDepNames": ["node", "pnpm"],
+      "enabled": false
+    }
+  ]
+}