default.json5

{
  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
  extends: ['mergeConfidence:all-badges', 'group:monorepos'],
  dependencyDashboard: true,
  rangeStrategy: 'replace',
  automerge: false,

  // Schedule Renovate to run during off-peak hours
  schedule: ['after 10:00pm every weekday', 'before 5:00am every weekday', 'every weekend'],
  prConcurrentLimit: 8,
  prHourlyLimit: 4,
  timezone: 'America/Tijuana',

  // Commit and PR customization
  commitBody: 'See associated pull request for more information.',
  semanticCommits: 'enabled',
  semanticCommitScope: '',
  semanticCommitType: 'build',
  labels: ['area: build & ci', 'action: merge', 'target: automation'],

  lockFileMaintenance: {
    enabled: true,
  },

  // Feature disabled: permission to enable vulnerability alerts is not granted
  vulnerabilityAlerts: {
    enabled: false,
  },

  // Ignored dependencies in all repositories
  ignoreDeps: [
    'rules_pkg',
    'yarn', // Yarn is copied locally in all repositories where needed.
  ],

  packageRules: [
    // ============================================================================
    // GENERAL GROUPING & UPDATE BEHAVIOR
    // ============================================================================

    // Enable 'postUpdateTasks' for changes that effect the BAZEL lockfile or generated files.
    // Renovate does not update Bazel lockfile for the time being.
    // Workaround for https://github.com/renovatebot/renovate/issues/25557
    {
      postUpgradeTasks: {
        commands: [
          'git restore .npmrc || true', // In case `.npmrc` avoid a hard error.
          'pnpm install --frozen-lockfile',
          'pnpm bazel mod deps --lockfile_mode=update',
        ],
        executionMode: 'branch',
      },
      matchManagers: ['bazel', 'bazel-module', 'bazelisk'],
    },

    // Rule to disable NPM updates on branches other than 'main'.
    // But allow updating engines and packageManagers.
    {
      enabled: false,
      matchBaseBranches: ['!main'],
      matchDepNames: ['!node', '!pnpm', '!npm', '!yarn'],
      matchManagers: ['npm'],
    },

    // Group all non-major dependencies together for updates.
    {
      groupName: 'all non-major dependencies',
      matchDepNames: ['*', '!node', '!pnpm', '!npm', '!yarn'],
      matchUpdateTypes: ['digest', 'patch', 'minor'],
      matchManagers: ['npm'],
    },

    // ============================================================================
    // ECOSYSTEM-SPECIFIC GROUPING
    // ============================================================================

    // Group Bazel updates
    {
      groupName: 'bazel dependencies',
      matchManagers: ['bazel', 'bazel-module'],
    },

    // Group GitHub Actions workflow
    {
      groupName: 'all github actions',
      matchManagers: ['github-actions'],
    },

    // ============================================================================
    // DEPENDENCY-SPECIFIC UPDATE CONTROLS
    // ============================================================================

    // Group updates related to Angular ecosystem across repositories
    {
      enabled: true, // Enable NPM updates of cross-repo dependencies on all branches.
      groupName: 'cross-repo angular dependencies',
      followTag: 'next',
      separateMajorMinor: false,
      schedule: ['at any time'],
      matchPackageNames: [
        '@angular-devkit/**',
        '@angular/**',
        '@schematics/**',
        'angular/**',
        'ng-packagr',
      ],
    },

    // @angular/benchpress is not released as 'next'
    {
      followTag: null,
      matchDepNames: ['@angular/benchpress'],
    },

    // Disable 'next' tag tracking on non-main branches
    {
      matchBaseBranches: ['!main'],
      followTag: null,
    },

    // Keep minor and patch updates separate for TypeScript
    {
      matchDepNames: ['typescript'],
      separateMinorPatch: true,
    },

    // Group TypeScript-related packages
    {
      groupName: 'typescript dependencies',
      matchDepNames: ['typescript', 'tslib'],
    },

    // Limit how many times these packages get updated (They deploy each merged PR)
    {
      matchDepNames: [
        'github/codeql-action',
        'google-closure-compiler',
        'quicktype-core',
        'renovate',
      ],
      schedule: ['on sunday and wednesday'],
    },

    // ============================================================================
    // EXCLUSION RULES
    // ============================================================================

    // Disable updates for placeholder or 0.0.0-style versions
    {
      enabled: false,
      matchCurrentVersion: '/^[~^]?0\\.0\\.0-/',
    },

    // Disable major updates for specified dependencies
    {
      enabled: false,
      matchDepNames: [
        '@types/node',
        'node',
        'bazel', // bazelisk bazel version
        'npm',
        'rxjs',
        'tslib',
        'yarn',
      ],
      matchUpdateTypes: ['major'],
    },

    // Disable TypeScript major and minor updates
    {
      enabled: false,
      matchDepNames: ['typescript'],
      matchUpdateTypes: ['major', 'minor'],
    },

    // Rule to disable major updates on branches other than 'main'.
    {
      enabled: false,
      matchBaseBranches: ['!main'],
      matchUpdateTypes: ['major'],
    },
  ],
}