renovate.json5

// See https://docs.renovatebot.com/configuration-options/ for more details
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    "github>whitesource/merge-confidence:beta", // https://github.com/whitesource/merge-confidence
  ],

  "baseBranches": ["main"],

  // for saving GitHub Actions minutes
  // We are going to remove this when we migrate to public repository
  "rebaseWhen": "never",

  "timezone": "Asia/Tokyo",

  "prHourlyLimit": 0, // # of PRs will be created but never exceed prConcurrentLimit. 0 means infinite.
  "prConcurrentLimit": 10, // # of PRs can be open at the time (security updates are not affected)

  "pruneBranchAfterAutomerge": true,
  "pruneStaleBranches": true,
  "automergeStrategy": "merge-commit",
  "labels": ["renovate-update"],

  // Add new managers if required
  "enabledManagers": [
    "swift",
    'bundler',
    'ruby-version',
    "github-actions",
    "gradle",
    "gradle-wrapper"
  ],

  "packageRules": [
    // GitHub Actions
    {
      "groupName": "gh-actions", // Aggregate updates to Actions into one PR.
      "prPriority": -1,
      "matchManagers": ["github-actions"],
      "matchDatasources": ["github-tags"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true,
      "platformAutomerge": true,
      "pinDigests": true, // Use digest instead of refs
      "schedule": ["after 10am before 5pm on wednesday"], // Weekly
    },
    // Others
    {
      "matchUpdateTypes": ["minor", "patch"],
      "matchCurrentVersion": "!/^0/",
      "automerge": true
    }
  ],

  "vulnerabilityAlerts": {
    "enabled": true
  },
  "osvVulnerabilityAlerts": true,

  "minor": {
    "minimumReleaseAge": "3 days", // for security reason
  },

  "patch": {
    "minimumReleaseAge": "2 days", // for security reason
  }
}