From a1f003a5328e448b3fb0ded63330226143a2e986 Mon Sep 17 00:00:00 2001
From: Oliver Meyer <oliverm@aignostics.com>
Date: Fri, 6 Nov 2026 13:58:52 +0100
Subject: [PATCH] chore(renovate): port the org config keys that this repo
 needs

Mend does not apply the org config to public repos. The Supply Chain Day
tracker flags prCreation not-pending, which holds most Renovate branches
without a PR. The checklist also forbids enabled: false.

- Port the org keys that this repo needs: config:best-practices,
  timezone, minimumReleaseAge 5 days, automerge, the pre-commit manager,
  vulnerability fixes with the security label and without automerge,
  and the rule that lets digest, pinDigest and lock file maintenance
  updates pass without a release timestamp.
- Port rebaseWhen conflicted. A rebase pushes to the PR branch, and the
  org ruleset then dismisses the approval, so automerge stalls again.
- Delete prCreation and the other keys that repeat the Renovate
  defaults. The default prCreation immediate matches the org value.
- Delete ignorePaths. Its only path does not exist.
- Replace the requires-python enabled: false rule. requires-python now
  widens, so a new Python raises only the upper bound. A "Python" group
  puts requires-python and .python-version in one PR, without automerge.
- Run mise-lock-sync when .python-version changes, so that mise.lock
  follows a Python upgrade.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/mise-lock-sync.yml |  1 +
 renovate.json                        | 56 ++++++++++++++++++++--------
 2 files changed, 41 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/mise-lock-sync.yml b/.github/workflows/mise-lock-sync.yml
index da036d2..ee7f3a6 100644
--- a/.github/workflows/mise-lock-sync.yml
+++ b/.github/workflows/mise-lock-sync.yml
@@ -15,6 +15,7 @@ on:
       - '.config/mise.toml'
       - '.config/mise/config.toml'
       - '.config/mise/conf.d/*.toml'
+      - '.python-version'
 
 jobs:
   sync-lockfile:
diff --git a/renovate.json b/renovate.json
index 25d238c..a764a3c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,38 +1,62 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "description": [
+    "This repo is public. Mend does not apply the org config (aignostics/renovate-config, org-inherited-config.json)",
+    "to public repos. This file ports the org keys that this repo needs. The Renovate defaults already match",
+    "the org values for prCreation, internalChecksFilter and minimumReleaseAgeBehaviour.",
+    "rebaseWhen conflicted: a rebase pushes to the PR branch, and the org ruleset then dismisses the approval."
+  ],
+  "extends": ["config:best-practices"],
   "timezone": "Europe/Berlin",
-  "schedule": ["at any time"],
-  "minimumReleaseAge": "14 days",
+  "minimumReleaseAge": "5 days",
   "automerge": true,
-  "automergeType": "pr",
-  "prCreation": "not-pending",
-  "internalChecksFilter": "strict",
-  "platformAutomerge": "true",
-  "labels": ["bot", "renovate", "dependencies", "skip:codecov"],
-  "ignorePaths": ["plugins/manifest/package.json"],
+  "rebaseWhen": "conflicted",
+  "vulnerabilityAlerts": {
+    "description": "A vulnerability fix skips minimumReleaseAge. No automerge: a person checks the fix before the merge.",
+    "addLabels": ["security"],
+    "automerge": false
+  },
   "pre-commit": {
     "enabled": true
   },
-  "vulnerabilityAlerts": {
-    "enabled": true,
-    "minimumReleaseAge": null
-  },
   "lockFileMaintenance": {
     "enabled": true,
     "schedule": ["before 5am on monday"]
   },
   "packageRules": [
     {
-      "description": "Do not bump requires-python: dropping supported Python versions is a breaking change for this library",
-      "matchDepTypes": ["requires-python"],
-      "enabled": false
+      "description": [
+        "From the org config. Digest, pinDigest and lock file maintenance updates have no release timestamp.",
+        "Under timestamp-required, they stay pending forever and never automerge (renovatebot/renovate#45236).",
+        "Remove this rule when renovatebot/renovate#46645 is released."
+      ],
+      "matchUpdateTypes": ["digest", "pinDigest", "lockFileMaintenance"],
+      "minimumReleaseAgeBehaviour": "timestamp-optional"
     },
     {
       "groupName": "minor and patch dependencies",
       "matchManagers": ["pep621"],
       "matchUpdateTypes": ["minor", "patch"]
     },
+    {
+      "description": [
+        "One PR for each Python minor or major update: requires-python and .python-version.",
+        "Without this rule, requires-python goes into the pep621 group alone and CI tests the old .python-version.",
+        "Keep this rule after the pep621 group rule. No automerge: a person adds the classifier and accepts the PR."
+      ],
+      "groupName": "Python",
+      "matchPackageNames": ["python"],
+      "matchUpdateTypes": ["minor", "major"],
+      "automerge": false
+    },
+    {
+      "description": [
+        "Widen requires-python: raise only the upper bound. The default strategy also raises the lower bound,",
+        "and a dropped Python version is a breaking change for this library."
+      ],
+      "matchDepTypes": ["requires-python"],
+      "rangeStrategy": "widen"
+    },
     {
       "groupName": "GitHub Actions",
       "matchManagers": ["github-actions"],