From 5c86aaaf6f22129de57d01f4762cb6eff3dbb98f Mon Sep 17 00:00:00 2001
From: Andrew Cockrell <1480054+acockrell@users.noreply.github.com>
Date: Fri, 15 May 2026 20:50:39 -0700
Subject: [PATCH] chore: enable Renovate platformAutomerge with safety guards

- Add platformAutomerge: true to all automerge rules and vulnerabilityAlerts
  so Renovate uses GitHub's native auto-merge API rather than direct merge
- Add minimumReleaseAge: "3 days" globally as supply chain safety net
- Extend Go dependencies rule with automerge (was grouping only)
- Collapse GitHub Actions into one rule covering minor/patch/digest
  (digest-only updates like SHA rotations now automerge)
---
 .github/renovate.json | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index a126c2a..4eff982 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -8,33 +8,35 @@
   ],
   "schedule": ["before 6am on Monday"],
   "timezone": "America/Vancouver",
+  "minimumReleaseAge": "3 days",
   "labels": ["dependencies"],
   "assignees": ["acockrell"],
   "vulnerabilityAlerts": {
     "labels": ["security", "dependencies"],
     "assignees": ["acockrell"],
     "schedule": ["at any time"],
-    "automerge": true
+    "automerge": true,
+    "platformAutomerge": true
   },
   "packageRules": [
     {
-      "description": "Group all Go dependencies (non-major)",
+      "description": "Group all Go dependencies (non-major), automerge minor/patch/digest",
       "matchDatasources": ["go"],
       "matchUpdateTypes": ["minor", "patch", "digest"],
-      "groupName": "Go dependencies"
+      "groupName": "Go dependencies",
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
     },
     {
-      "description": "Group all GitHub Actions and pin to digest SHAs",
+      "description": "Group all GitHub Actions, pin to digest SHAs, automerge all non-major",
       "matchManagers": ["github-actions"],
       "groupName": "GitHub Actions",
-      "pinDigests": true
-    },
-    {
-      "description": "Automerge GitHub Actions minor/patch updates",
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["minor", "patch"],
+      "pinDigests": true,
+      "matchUpdateTypes": ["minor", "patch", "digest"],
       "automerge": true,
       "automergeType": "pr",
+      "platformAutomerge": true,
       "automergeStrategy": "squash"
     },
     {
@@ -42,6 +44,7 @@
       "matchUpdateTypes": ["patch"],
       "automerge": true,
       "automergeType": "pr",
+      "platformAutomerge": true,
       "automergeStrategy": "squash"
     },
     {