// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

// Renovate proposes the version updates of this repository. Dependabot keeps
// its alerts and its security updates, which are repository settings; its
// version updates are off, so that two bots do not open the same pull
// request.
{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],

  timezone: "Europe/Istanbul",
  // Once a week, before the working day.
  schedule: ["before 6am on monday"],

  // A release is taken a week after it is published: one that turns out to
  // be broken or malicious is usually withdrawn within days.
  minimumReleaseAge: "7 days",

  // A pull request is rebased when it conflicts, not whenever the default
  // branch moves, so that a merge does not start the tests of every open
  // update again.
  rebaseWhen: "conflicted",
  prConcurrentLimit: 2,
  prHourlyLimit: 2,

  // One issue lists what is pending, so an update need not be a pull request
  // to be seen.
  dependencyDashboard: true,

  // Security fixes come from Dependabot security updates. Renovate does not
  // open its own for the same advisory.
  vulnerabilityAlerts: { enabled: false },

  ignorePaths: ["**/node_modules/**"],

  // What Dependabot watched here, and nothing more for now.
  enabledManagers: ["github-actions", "npm"],

  // One pull request for each kind of dependency.
  packageRules: [
    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
    { matchManagers: ["npm"], groupName: "Site packages" },
  ],
}