[olivermeyer]

Why?
Mend does not apply the org Renovate config to public repos, so no org rule reaches this repo: not the 5-day release age, the security-fix handling, Conventional Commits or the pre-commit manager. The org Slack rule says a renovate.json with only $schema gets the org defaults, which is not true here.

How?
renovate.json now holds the parts of org-inherited-config.json from aignostics/renovate-config@2e5f0a7ea7d3 that this repo uses, in the layout of aignostics/foundry-python-core#141. The header lists what is left out and why: hostRules (a missing Mend secret stops Renovate), onboardingPrTitle, the custom managers, and the rules for registries this repo does not use. The repo rules stay in two marked sections, with a new "Python" group for requires-python and .python-version, a "pre-commit hooks" group and the copier manager off, and labels.yml gets the manager labels that addLabels adds, so the label sync does not delete them.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/renovate-org-config → main

View scan in OX Security →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

❗ There is a different number of reports uploaded between BASE (4776518) and HEAD (a98f8ae). Click for more details.

HEAD has 8 uploads less than BASE

Flag	BASE (4776518)	HEAD (a98f8ae)
	9	1

see 18 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[claude]

Claude finished @olivermeyer's task in 2m 21s —— View job

---

PR Review: Renovate Configuration Update

Reviewing PR #764: chore(renovate): copy the needed org config and keep the repo rules

Todo List

• Read and analyze changed files (renovate.json, .github/labels.yml)
• Verify commit message follows conventional commits format
• Review Renovate configuration for correctness and security
• Review GitHub labels configuration
• Check if documentation updates needed
• Post comprehensive review findings
• Apply verdict label

---

Review Summary

No blocking issues found. This is a well-executed configuration change with excellent documentation.

Critical Checks

✅ Conventional Commits

• Commit message: chore(renovate): copy the needed org config and keep the repo rules
• Follows the required format: type(scope): description
• Type chore is appropriate for configuration changes

✅ Security & Best Practices (renovate.json)

• Release age policy: 5-day minimum wait before adopting new releases (minimumReleaseAge)
• Vulnerability scanning: osvVulnerabilityAlerts: true queries osv.dev for CVEs
• Security fix handling: Vulnerability PRs skip automerge and require manual review (line 52-56)
• Conventional commits: semanticCommits: "enabled" aligns with repo requirements
• No secrets exposed: Configuration is safe for public repo

✅ Renovate Configuration Quality

The renovate.json file is exceptionally well-documented:

1. Header documentation (lines 4-14): Clearly explains what was copied from org config and what was intentionally left out
2. Inline comments: Every configuration section has clear explanations
3. Repo-specific sections marked: Lines 108-109 and 151 clearly delineate repo rules from org rules
4. Python-specific handling:
   • rangeStrategy: "widen" prevents breaking changes for library consumers (lines 168-175)
   • Python version updates require manual review with automerge disabled (lines 158-167)
   • Runtime-critical packages (nicegui, httpx, pydantic, etc.) run long E2E tests (lines 177-192)

✅ GitHub Labels Configuration

The .github/labels.yml changes (lines 72-87) add four manager labels:

• github-actions, pep621, pre-commit, pyenv
• Matches Renovate's addLabels: ["renovate", "{{{manager}}}"] on line 84 of renovate.json
• Color consistency: All use d1df30 matching the main renovate label
• Purpose: Prevents label sync workflow from deleting labels that Renovate automatically adds

Repository-Specific Observations

CI/CD Integration

• Test skip labels (skip:test:long_running, skip:codecov) on line 123 match CI expectations from .github/CLAUDE.md
• Runtime-critical package rule (lines 177-192) drops skip:test:long_running to run full E2E suite
• Aligns with the test execution strategy documented in .github/CLAUDE.md

Medical Device Context

• Configuration supports the maintenance mode stated in root CLAUDE.md
• Security practices (release age, manual review for vulnerabilities) appropriate for medical device software
• Dependency update strategy balances security with stability

Suggestions (Non-blocking)

Documentation Enhancement: Consider adding a brief note to .github/CLAUDE.md explaining the Renovate configuration setup. Something like:

## Dependency Management (Renovate)

This repo's `renovate.json` contains org-level configuration because Mend does not apply 
the org config (aignostics/renovate-config) to public repos. The file is well-documented 
with inline comments explaining each rule. Repo-specific rules are marked in two sections.

This would help future contributors understand why the file is so comprehensive compared to typical Renovate configs.

Test Coverage Impact

N/A - No code changes, only configuration files. All CI checks (OX Security, Codecov, SonarQube) have passed.

Breaking Changes

None - This is additive configuration. Renovate will start using these rules for future PRs. No changes to SDK APIs or behavior.

---

Verdict: ✅ claude:review:passed

Excellent work on this PR! The configuration is correct, well-documented, and follows security best practices. The inline documentation in renovate.json is particularly commendable—it will make future maintenance much easier.

---