{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "_comment": "Renovate config — Phase 4 automated updates (ADR-0009, R-UPD-01/02). Renovate owns HELM CHART + DEPENDENCY bumps (opens PRs; allowed classes auto-merge on green CI). Flux image-automation owns per-service container IMAGE TAGS (the $imagepolicy setters). The two do NOT overlap: this config DISABLES image-tag updates so Renovate never fights Flux over a running version. Self-hosted against the bootstrap Gitea; platform: gitea set at runtime by the operator's renovate runner.",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    "helpers:pinGitHubActionDigests"
  ],
  "timezone": "America/New_York",
  "schedule": ["after 3am and before 6am"],
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "commitMessagePrefix": "chore(deps):",
  "labels": ["dependencies", "automated-update"],
  "ignoreUnstable": true,
  "respectLatest": true,
  "enabledManagers": ["flux", "kustomize", "helmv3", "regex", "github-actions"],
  "flux": {
    "managerFilePatterns": ["/(^|/)platform/.+\\.ya?ml$/", "/(^|/)apps/.+\\.ya?ml$/"]
  },
  "kustomize": {
    "managerFilePatterns": ["/(^|/)kustomization\\.ya?ml$/"]
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "Inline `# renovate: datasource=... depName=...` markers on pinned URLs / version literals (e.g. platform/kubevirt/kustomization.yaml release URLs, ci/versions.env, infra/devcontainer/versions.env).",
      "managerFilePatterns": [
        "/(^|/)kustomization\\.ya?ml$/",
        "/(^|/)versions\\.env$/"
      ],
      "matchStrings": [
        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s*\\n.*?(?<currentValue>v?[0-9]+\\.[0-9]+\\.[0-9]+)"
      ],
      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
    }
  ],
  "packageRules": [
    {
      "description": "Auto-merge the allowed low-risk classes on green CI — no human authoring (R-UPD-02). The Gitea merge gate (make -C ci gate) is the required check.",
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    },
    {
      "description": "MAJOR / potentially-breaking bumps require human review (docs/11 safety rail). Never auto-merged.",
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "addLabels": ["needs-review", "breaking"]
    },
    {
      "description": "Keep the KubeVirt + CDI operator pair on a compatible track — grouped so they bump together (platform/kubevirt/kustomization.yaml).",
      "matchDepNames": ["kubevirt/kubevirt", "kubevirt/containerized-data-importer"],
      "groupName": "kubevirt-cdi"
    },
    {
      "description": "Pinned tool versions (ci/versions.env, infra/devcontainer/versions.env) are a deliberate change surface — label but do not auto-merge; a version bump there changes CI reproducibility.",
      "matchFileNames": ["ci/versions.env", "infra/devcontainer/versions.env"],
      "automerge": false,
      "addLabels": ["ci-tooling"]
    }
  ],
  "ignorePaths": [
    "**/*.example",
    "**/*.sops.yaml",
    "conformance/**",
    "platform/image-automation/per-service/**"
  ],
  "docker": { "enabled": false },
  "kubernetes": { "enabled": false }
}