{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "semanticCommitType": "chore",
  "semanticCommits": "enabled",
  "commitMessageLowerCase": "auto",

  "labels": ["dependencies"],

  "platformAutomerge": false,
  "automerge": false,

  "prHourlyLimit": 4,
  "prConcurrentLimit": 10,

  "schedule": ["every weekday before 6am"],

  "packageRules": [
    {
      "description": "Group pre-commit hook updates together",
      "matchManagers": ["pre-commit"],
      "matchUpdateTypes": ["minor", "patch"],
      "enabled": true,
      "groupName": "pre-commit hooks"
    },
    {
      "description": "Group Nix flake inputs together — minors/patches in one PR",
      "matchManagers": ["flake"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "nix flake inputs (minor/patch)",
      "prPriority": -1,
      "labels": ["dependencies", "nix"]
    },
    {
      "description": "Nix flake major bumps get individual PRs for review",
      "matchManagers": ["flake"],
      "matchUpdateTypes": ["major"],
      "prPriority": 1,
      "labels": ["dependencies", "nix", "major"]
    },
    {
      "description": "Group Helm chart updates by ecosystem",
      "matchManagers": ["helm-values", "helmfile"],
      "groupName": "helm chart versions",
      "prPriority": -1,
      "labels": ["dependencies", "helm"]
    },
    {
      "description": "Group Docker base image minors/patches — one PR at a time",
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "docker base images (minor/patch)",
      "prPriority": -1,
      "labels": ["dependencies", "docker"]
    },
    {
      "description": "Docker major bumps reviewed individually",
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["major"],
      "prPriority": 1,
      "labels": ["dependencies", "docker", "major"]
    },
    {
      "description": "Group Kubernetes manifest image tag updates (minor/patch)",
      "matchManagers": ["kubernetes-image"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "k8s container images (minor/patch)",
      "prPriority": -1,
      "labels": ["dependencies", "k8s"]
    },
    {
      "description": "Kubernetes image major bumps reviewed individually",
      "matchManagers": ["kubernetes-image"],
      "matchUpdateTypes": ["major"],
      "prPriority": 1,
      "labels": ["dependencies", "k8s", "major"]
    },
    {
      "description": "Python Poetry deps grouped together",
      "matchManagers": ["pip_requirements", "poetry"],
      "groupName": "python dependencies",
      "prPriority": -1,
      "labels": ["dependencies", "python"]
    },
    {
      "description": "GitHub Actions — group all action version updates",
      "matchManagers": ["github-actions"],
      "groupName": "github actions",
      "enabled": true,
      "labels": ["dependencies", "ci"]
    },
    {
      "description": "Major bumps always get separate PRs (unless overridden above)",
      "matchUpdateTypes": ["major"],
      "prPriority": 1,
      "labels": ["major"]
    },
    {
      "description": "Disable noisy or unnecessary managers",
      "enabled": false,
      "matchManagers": ["npm"],
      "matchPaths": ["docker/site/**"]
    },
    {
      "description": "OpenTofu/core patch+minor bumps automerge once plan-gate contexts are green (non-0.x)",
      "matchManagers": ["terraform", "terraform-version", "terraform-requiredVersion", "terraform-lockfile"],
      "matchUpdateTypes": ["patch", "minor"],
      "matchCurrentVersion": "!/^0/",
      "labels": ["dependencies", "risk-low"],
      "automerge": true,
      "platformAutomerge": true,
      "automergeType": "pr",
      "automergeStrategy": "squash"
    },
    {
      "description": "0.x terraform deps: Renovate classes every bump as minor — treat as breaking-class, hold",
      "matchManagers": ["terraform", "terraform-version", "terraform-requiredVersion", "terraform-lockfile"],
      "matchCurrentVersion": "/^0/",
      "labels": ["dependencies", "risk-med"],
      "automerge": false,
      "platformAutomerge": false
    },
    {
      "description": "Terraform majors stay open for human review (never suppressed)",
      "matchManagers": ["terraform", "terraform-version", "terraform-requiredVersion", "terraform-lockfile"],
      "matchUpdateTypes": ["major"],
      "labels": ["dependencies", "risk-high"],
      "automerge": false,
      "platformAutomerge": false
    },
    {
      "description": "Cluster-core terraform (proxmox/talos) never automerges regardless of semver tier",
      "matchManagers": ["terraform", "terraform-version", "terraform-requiredVersion", "terraform-lockfile"],
      "matchFileNames": ["tofu/proxmox/talos/**"],
      "labels": ["dependencies", "risk-high"],
      "automerge": false,
      "platformAutomerge": false
    }
  ],

  "ignoreDeps": [],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"]
  },
  "osvVulnerabilityAlerts": true
}