{
	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
	"extends": [
		"config:recommended"
	],
	"schedule": [
		"* 0-6 * * 1"
	],
	"prConcurrentLimit": 8,
	"minimumReleaseAge": "3 days",
	"labels": ["dependencies"],
	"reviewers": ["DataHearth"],
	"postUpdateOptions": ["gomodTidy"],
	"gitIgnoredAuthors": ["41898282+github-actions[bot]@users.noreply.github.com"],
	"customManagers": [
		{
			"customType": "regex",
			"description": "Go's version, from go.dev's release list: go.mod's `go` directive and the Dockerfile's GO_VERSION, moved in one PR. nix/go.nix overrides nixpkgs' go_1_NN onto it; renovate-pins.yaml re-pins GO_DIGEST and derives the source hash.",
			"managerFilePatterns": ["/^go\\.mod$/", "/^deploy/Dockerfile$/"],
			"matchStrings": ["(?m)^go (?<currentValue>\\d+\\.\\d+\\.\\d+)$", "(?m)^ARG GO_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)$"],
			"depNameTemplate": "go",
			"datasourceTemplate": "golang-version"
		},
		{
			"customType": "regex",
			"description": "Node's version, from nodejs.org's release list: engines.node (a `>=` floor), the Dockerfile's node tag and every setup-node node-version, moved in one PR. nix/node.nix overrides nixpkgs' nodejs_NN onto it; renovate-pins.yaml re-pins the image digest and derives the source hash.",
			"managerFilePatterns": ["/^package\\.json$/", "/^deploy/Dockerfile$/", "/^\\.github/workflows/[^/]+\\.yaml$/"],
			"matchStrings": ["\"node\": \">=(?<currentValue>\\d+\\.\\d+\\.\\d+)\"", "FROM node:(?<currentValue>\\d+\\.\\d+\\.\\d+)-alpine", "(?m)^\\s*node-version: (?<currentValue>\\d+\\.\\d+\\.\\d+)$"],
			"depNameTemplate": "node",
			"datasourceTemplate": "node-version",
			"versioningTemplate": "node"
		}
	],
	"packageRules": [
		{
			"matchManagers": ["gomod"],
			"matchUpdateTypes": ["minor", "patch", "digest"],
			"groupName": "go modules"
		},
		{
			"matchManagers": ["npm"],
			"matchUpdateTypes": ["minor", "patch", "digest"],
			"groupName": "frontend deps"
		},
		{
			"matchManagers": ["github-actions"],
			"matchUpdateTypes": ["minor", "patch", "digest"],
			"groupName": "github actions"
		},
		{
			"matchManagers": ["github-actions"],
			"addLabels": ["github_actions"]
		},
		{
			"matchManagers": ["dockerfile", "docker-compose"],
			"matchUpdateTypes": ["minor", "patch", "digest"],
			"groupName": "docker images"
		},
		{
			"matchManagers": ["helmv3", "helm-values"],
			"matchUpdateTypes": ["minor", "patch", "digest"],
			"groupName": "helm charts"
		},
		{
			"matchUpdateTypes": ["major"],
			"dependencyDashboardApproval": true
		},
		{
			"description": "go.mod's own `go` directive is bumped by the regex manager below, which moves the Dockerfile's GO_VERSION in the same PR; left on, gomod would bump the directive alone and leave the copy behind. Same for the node and golang images and the setup actions' node-version, which the node and go regex managers own.",
			"matchManagers": ["gomod"],
			"matchDepTypes": ["golang", "toolchain"],
			"enabled": false
		},
		{
			"matchManagers": ["npm", "dockerfile", "github-actions"],
			"matchDepNames": ["node", "golang"],
			"enabled": false
		},
		{
			"description": "The PR that moves the locked nixpkgs. It touches no toolchain version: nix/{go,node,pnpm}.nix override nixpkgs' package onto the declared patch while the two differ, and .github/workflows/renovate-pins.yaml drops the override's hashes from nix/toolchains.json once the lock catches up. After the major gate on purpose — the later rule wins, so this overrides the major-update dashboard gate above, which a nixpkgs revision would otherwise sit behind forever.",
			"matchManagers": ["nix"],
			"groupName": "nix inputs",
			"dependencyDashboardApproval": false
		},
		{
			"description": "pnpm: package.json's packageManager field and the setup action in CI. Split, they would be two PRs for one upgrade.",
			"matchManagers": ["npm", "github-actions"],
			"matchDepNames": ["pnpm", "pnpm/action-setup"],
			"groupName": "pnpm",
			"dependencyDashboardApproval": false
		},
		{
			"description": "A new Go minor is a new nixpkgs line (go_1_NN), so it waits on the dashboard until nixpkgs packages it; nix/go.nix throws on a line it does not have. Patches open straight away — that is the point of sourcing them from go.dev rather than from the lock.",
			"matchManagers": ["custom.regex"],
			"matchDepNames": ["go"],
			"matchUpdateTypes": ["minor", "major"],
			"dependencyDashboardApproval": true
		},
		{
			"description": "The pnpm rule above lifts the dashboard gate for the whole group; a pnpm major is a new nixpkgs line (pnpm_NN) and has to wait for it like Go's minor. Node needs no rule of its own: its line is the major, which the generic major gate already holds.",
			"matchManagers": ["npm"],
			"matchDepNames": ["pnpm"],
			"matchUpdateTypes": ["major"],
			"dependencyDashboardApproval": true
		}
	],
	"vulnerabilityAlerts": {
		"schedule": ["at any time"]
	}
}