{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "docker:enableMajor"
  ],
  "labels": ["dependencies"],
  "timezone": "Europe/Tallinn",
  "schedule": ["every weekend"],
  "pinDigests": true,
  "platformAutomerge": true,
  "prConcurrentLimit": 5,
  "packageRules": [
    {
      "description": "Automerge Docker patch, minor, and digest updates. Critical infrastructure opts back out in a later rule.",
      "matchManagers": ["docker-compose", "dockerfile"],
      "matchUpdateTypes": ["patch", "minor", "digest"],
      "automerge": true
    },
    {
      "description": "Major updates need manual review",
      "matchManagers": ["docker-compose", "dockerfile"],
      "matchUpdateTypes": ["major"],
      "labels": ["dependencies", "breaking"]
    },
    {
      "description": "Home Assistant's monthly release (2026.9 -> 2026.10) is a minor to Renovate but carries breaking changes, so it waits for review in its own PR. Patches (2026.9.x) keep automerging. Placed after the automerge rule so it overrides it.",
      "matchPackageNames": ["ghcr.io/home-assistant/home-assistant"],
      "matchUpdateTypes": ["minor"],
      "automerge": false
    },
    {
      "description": "Critical infrastructure: never automerge, collect every update type into one PR. Placed after the automerge rule so it overrides it, which keeps the package list in exactly one place.",
      "matchManagers": ["docker-compose", "dockerfile"],
      "matchUpdateTypes": ["patch", "minor", "major", "digest"],
      "matchPackageNames": [
        "adguard/adguardhome",
        "cloudflare/cloudflared",
        "docker.io/valkey/valkey",
        "ghcr.io/immich-app/immich-machine-learning",
        "ghcr.io/immich-app/immich-server",
        "ghcr.io/immich-app/postgres",
        "jc21/nginx-proxy-manager",
        "tecnativa/docker-socket-proxy",
        "vaultwarden/server"
      ],
      "automerge": false,
      "groupName": "critical infrastructure",
      "groupSlug": "critical-updates"
    },
    {
      "description": "Estate images (ghcr.io/khelias/*) are pinned by their own repo's CI, which opens a pin PR here after each publish (estate ADR-008). Renovate's registry lookups lag the registry, so it would propose an older digest after CI moved the pin and automerge a silent downgrade.",
      "matchPackageNames": ["ghcr.io/khelias/**"],
      "enabled": false
    }
  ]
}