From 1c89a8e33b1f40d4fc105ff62b9227f19f7afa32 Mon Sep 17 00:00:00 2001
From: Baptiste Canton <bat@sbz.fr>
Date: Sun, 23 Aug 2026 00:18:53 +0200
Subject: [PATCH] chore(renovate): document every rule, drop the inert digest
 gate

The config had grown to seven packageRules with a single description
between them, so there was no way to tell which rules were load-bearing
and which were fossils. Rules nobody dares delete are how a config only
ever grows.

Add a top-level description stating the policy (weekly batches,
automerge on green, majors gated on the dashboard, 7-day release age,
digest pinning), and a description on every rule. Some genuinely read as
mistakes without one: "enabled": true on the indirect rule looks like a
no-op but is required, and the majors rule carrying both automerge and
dependencyDashboardApproval looks contradictory until you know that
ticking the box is the approval.

Drop the gomod digest rule. It used a nested updateType object that
never took effect (the x/exp digest branch was created without ever
appearing under Pending Approval) and it contradicted the automerge rule
above it. Pseudo-version bumps now ride the same test matrix and 7-day
gate as everything else.

No other behaviour change: the diff is descriptions plus that deletion.
Validated with renovate-config-validator v44.39 (the hosted app) and
v40.62.1 (the version pinned in .pre-commit-config.yaml).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/renovate.json | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index bbc5dfc51..9beb794ff 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,5 +1,12 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": [
+    "Update policy for this repo, in one place. Renovate opens one grouped batch of PRs on Monday mornings (Europe/Paris).",
+    "Minor, patch and digest updates merge themselves once the required checks are green. Majors do not: they wait for you to tick their box on the Dependency Dashboard (issue #10), and merge once you do.",
+    "Nothing is proposed until it has been public for 7 days (minimumReleaseAge), which is the main defence against a compromised or yanked release.",
+    "GitHub Actions and Docker base images are pinned to digests, so a moving tag cannot change what CI runs without a PR.",
+    "Every packageRule below carries a description saying why it exists; keep it that way, and delete a rule rather than leaving it unexplained."
+  ],
   "dependencyDashboardAutoclose": true,
   "extends": [
     "config:recommended",
@@ -20,6 +27,7 @@
   },
   "packageRules": [
     {
+      "description": "the routine case: low-risk updates merge themselves once the required checks pass. The 7-day minimumReleaseAge and the test matrix are the gate here, not human review.",
       "automerge": true,
       "matchUpdateTypes": [
         "minor",
@@ -30,6 +38,7 @@
       ]
     },
     {
+      "description": "majors can break the build or change behaviour, so they wait for a human to tick their box on the Dependency Dashboard (issue #10). automerge still applies afterwards: approving on the dashboard IS the approval, and the PR merges once checks are green.",
       "automerge": true,
       "dependencyDashboardApproval": true,
       "matchUpdateTypes": [
@@ -37,6 +46,7 @@
       ]
     },
     {
+      "description": "the exception to the rule above. Action majors are almost always a runner or Node runtime bump rather than a behaviour change, they are covered by every workflow running on the PR itself, and the digests are pinned, so waiting on a human buys nothing.",
       "groupName": "github actions (major)",
       "matchManagers": [
         "github-actions"
@@ -48,14 +58,7 @@
       "dependencyDashboardApproval": false
     },
     {
-      "matchManagers": [
-        "gomod"
-      ],
-      "digest": {
-        "dependencyDashboardApproval": true
-      }
-    },
-    {
+      "description": "Renovate ignores indirect Go dependencies unless told otherwise, so 'enabled' here is load-bearing, not a no-op. Grouping them keeps transitive churn to a single PR.",
       "matchManagers": [
         "gomod"
       ],
@@ -89,6 +92,7 @@
       "enabled": false
     },
     {
+      "description": "the AWS SDK ships a release most weekdays and splits into ~15 modules, so the default schedule would bury every other update. Monthly, grouped, is enough for an S3 opener.",
       "groupName": "aws-go-sdk-v2 monorepo",
       "groupSlug": "aws-go-sdk-v2",
       "matchDatasources": [