From f523b9b2bd34aee463be981eb0ca31b9a3a06d2c Mon Sep 17 00:00:00 2001
From: Eric J <eric@jbjinsurance.com>
Date: Mon, 17 Aug 2026 11:42:18 -0700
Subject: [PATCH] Adopt the org Renovate preset and add a release-age floor

Renovate has never actually run here: no PRs, no dependency dashboard.
The config file existed but the app installation is scoped to selected
repos and this one is not among them, so the file has been inert since
the repo was created.

Two things were missing on its own merits. There was no minimumReleaseAge,
so the first run would have been free to propose same-day publishes - the
other four repos in the org all set a 48-hour to 3-day floor. And the
settings it did carry were a partial copy of the sibling configs.

Extending the org preset supplies the timezone, the Monday batch,
automerge:false, the PR caps, the dashboard, OSV alerts, the security
bypass and the github-actions grouping. What is left here is the cargo
grouping and the two age floors.

The preset also brings helpers:pinGitHubActionDigests, which is new for
this repo - expect one PR re-pinning actions/checkout@v4 to a SHA.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqNvPFuFeotbk9TsngcNvh
---
 .github/renovate.json5 | 49 ++++++++++++++++++++++++++----------------
 1 file changed, 31 insertions(+), 18 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 084db80..a0d893c 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,34 +1,47 @@
+// Dependency automation for this repo. Most of the settings that used to be
+// written out here now come from the org preset below - schedule, timezone,
+// automerge, the security bypass, the github-actions grouping. What is left is
+// what is true about THIS repo and nowhere else.
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
-  extends: ["config:recommended"],
 
-  // One batch a week rather than a trickle. Monday morning means a failed
-  // update is looked at on a weekday, not discovered the following weekend.
-  schedule: ["* 0-8 * * 1"],
-  timezone: "America/Los_Angeles",
+  // Supplies config:recommended, helpers:pinGitHubActionDigests, the
+  // America/Los_Angeles timezone, the "before 6am on monday" batch,
+  // automerge:false, prConcurrentLimit/prHourlyLimit, dependencyDashboard,
+  // osvVulnerabilityAlerts, the rule that security fixes skip the weekly
+  // window, and the github-actions grouping.
+  // Source: https://github.com/FactoryGameFan/.github/blob/main/renovate-config.json
+  //
+  // The Monday window this replaces was `* 0-8 * * 1`, i.e. midnight to 8am;
+  // the preset's "before 6am on monday" is the same idea, two hours tighter.
+  //
+  // pinGitHubActionDigests is NEW here and is the org rule rather than a
+  // preference of this repo: three sibling repos already pin actions to a
+  // commit SHA with a `# vX.Y.Z` comment beside it. Expect one PR rewriting the
+  // single `actions/checkout@v4` in .github/workflows/ci.yml to a SHA.
+  extends: ["local>FactoryGameFan/.github:renovate-config"],
 
-  // Nothing automerges, with no exceptions. A green CI run proves the repo is
-  // consistent, not that a bump is correct - and this tool's correctness lives
-  // in fixtures captured from a game CI cannot run.
-  automerge: false,
+  // Three days of soak before anything is proposed. Nothing about this repo's
+  // toolchain forces the number - it matches the sibling Rust and npm repos so
+  // a yanked publish has time to disappear before it reaches a PR.
+  minimumReleaseAge: "3 days",
 
-  // Security fixes deliberately skip the weekly window.
   vulnerabilityAlerts: {
-    enabled: true,
-    schedule: ["at any time"],
+    // The preset already lets security fixes skip the weekly window. This drops
+    // the soak above to about a day for those rather than to zero.
+    minimumReleaseAge: "25 hours",
   },
 
-  // The toolchain pin is a deliberate control, not a stale dependency. Bumping
-  // it is a decision, so it gets its own PR rather than riding along in a batch.
   packageRules: [
     {
+      // The correctness of this tool lives in fixtures captured from the game,
+      // which CI cannot run - so a green CI run proves the crate still compiles,
+      // not that a bump is right. Batching the low-risk half keeps the reading
+      // load on the half that deserves it. Nothing automerges; see the preset.
+      description: "Group cargo patch and minor bumps into one PR.",
       matchManagers: ["cargo"],
       matchUpdateTypes: ["patch", "minor"],
       groupName: "cargo patch and minor",
     },
-    {
-      matchManagers: ["github-actions"],
-      groupName: "github actions",
-    },
   ],
 }