From 2d53b23aebc3ed919ca4a33fbaf32325989e7df0 Mon Sep 17 00:00:00 2001
From: basmith7 <basmith7@gmail.com>
Date: Sat, 31 Oct 2026 22:34:33 -0700
Subject: [PATCH] Renovate: base images wait for a person; Node majors need
 dashboard approval

PR CI never builds images, so a FROM bump (golf-swing python 3.12 -> 3.13)
would merge untested; a Node major must move templates/next-prisma and
node-ci first, else 16 repos get a Node 26 PR, 7 of them red on drift.
Also one PR title style across repos (semanticCommits disabled).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md    |  9 ++++++---
 default.json | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 5af4e4d..c7cc851 100644
--- a/README.md
+++ b/README.md
@@ -70,11 +70,14 @@ see the diff). A Node major bump lands here first (the `FROM` lines, and `node-c
 ## Renovate: `default.json`
 
 The one dependency-update policy. A repo opts in with a `renovate.json` of
-`{"extends": ["github>basmith7/workflows"]}` once its default branch runs shared CI (Renovate
-merges only after CI passes, and a repo with no checks has nothing to wait for). Minor and patch
+`{"extends": ["github>basmith7/workflows"]}` once CI gates its pull requests (Renovate merges only
+after CI passes, and a repo with no checks has nothing to wait for). Minor and patch
 updates arrive as one grouped PR each Monday morning and merge themselves (`platformAutomerge` is
 off because free private repos have no required checks, so GitHub's own auto-merge would not
-wait for CI); majors open as PRs for a person. `basmith7/workflows@main` refs are never touched.
+wait for CI); majors open as PRs for a person. Base-image (`FROM`) updates come as their own PR
+and wait for a person, because PR CI never builds the image; a Node major opens only when ticked on
+the Dependency Dashboard, since it moves `templates/next-prisma` and node-ci's default first.
+`basmith7/workflows@main` refs are never touched.
 
 Renovate regenerates lockfiles with npm 11 (`constraints`). Its default npm 12 refuses the registry
 tarball URLs in Tailwind's lockfile entries (`EALLOWREMOTE`, npm/cli#9800), and npm 10 fails on
diff --git a/default.json b/default.json
index 1ffe992..ef8e099 100644
--- a/default.json
+++ b/default.json
@@ -9,6 +9,7 @@
   "platformAutomerge": false,
   "automergeType": "pr",
   "automergeStrategy": "merge-commit",
+  "semanticCommits": "disabled",
   "constraints": { "npm": "^11" },
   "hostRules": [
     {
@@ -29,6 +30,19 @@
       "matchUpdateTypes": ["major"],
       "automerge": false
     },
+    {
+      "description": "Base images are never built by PR CI, so their updates wait for a person.",
+      "matchManagers": ["dockerfile"],
+      "groupName": "base images",
+      "groupSlug": "base-images",
+      "automerge": false
+    },
+    {
+      "description": "A Node major moves templates/next-prisma and node-ci first; it opens only when ticked on the dashboard.",
+      "matchDepNames": ["node"],
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    },
     {
       "description": "Callers track basmith7/workflows at @main on purpose; never pin or bump it.",
       "matchManagers": ["github-actions"],