// Renovate configuration for YellowJacket.
// Self-hosted via .github/workflows/renovate.yml — no external app required.
//
// Design decisions:
//   - PR titles use "chore(deps):" prefix to satisfy commitlint and avoid
//     triggering a semantic-release version bump on merge.
//   - Go and frontend (pnpm) dependency updates are grouped separately to keep
//     PRs reviewable and CI matrix manageable.
//   - GitHub Actions are tracked and grouped into a single PR.
//   - Beep (gopxl/beep) is grouped with other Go dependencies.
//   - Go tool directives (templ, sqlc, lefthook) are tracked automatically.
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",

  // Inherit sensible defaults (schedule, automerge policies, etc.).
  "extends": [
    "config:recommended",
    "docker:pinDigests",
    ":semanticCommits",
    ":semanticCommitTypeAll(chore)",
    ":semanticCommitScopeDisabled",
    "schedule:weekends",
  ],

  // Use conventional-commit PR titles that satisfy the commitlint job.
  "commitMessagePrefix": "chore(deps):",
  "commitMessageAction": "update",

  // Create PRs immediately so CI runs on them.
  "prCreation": "immediate",
  "prHourlyLimit": 3,
  "prConcurrentLimit": 5,

  // Keep the lockfile in sync.
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on monday"],
  },

  // ── Manager-specific settings ──────────────────────────────
  "gomod": {
    "enabled": true,
    // Let Renovate run `go mod tidy` after bumping versions.
    "postUpdateOptions": ["gomodTidy"],
    // Re-run code generation after dependency updates so that generated files
    // (templ *_templ.go, sqlc sqlcgen/) stay in sync with their tool versions.
    "postUpgradeTasks": {
      "commands": ["go generate ./..."],
      "fileFilters": ["**/*.go", "go.sum"],
      "executionMode": "update",
    },
  },

  "npm": {
    "enabled": true,
    // Lockfile lives in frontend/, Renovate auto-detects this.
  },

  // ── Package rules ──────────────────────────────────────────
  "packageRules": [
    // 1. Group all non-major Go dependency updates.
    {
      "description": "Group minor/patch Go dependency updates",
      "matchManagers": ["gomod"],
      "matchUpdateTypes": ["minor", "patch", "digest"],
      "groupName": "go dependencies (non-major)",
    },

    // 2. Group all non-major frontend dependency updates.
    {
      "description": "Group minor/patch frontend dependency updates",
      "matchManagers": ["npm"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "frontend dependencies (non-major)",
    },

    // 3. Group GitHub Actions updates.
    {
      "description": "Group GitHub Actions updates",
      "matchManagers": ["github-actions"],
      "groupName": "github actions",
    },

    // 4. Major updates get individual PRs for careful review.
    {
      "description": "Separate PRs for major updates",
      "matchUpdateTypes": ["major"],
      "groupName": null,
      "commitMessagePrefix": "chore(deps)!:",
    },

    // 5. Auto-merge patch-level updates for dev dependencies.
    {
      "description": "Auto-merge patch updates for frontend devDependencies",
      "matchManagers": ["npm"],
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr",
    },

    // 6. Pin htmx.org — it uses exact versioning intentionally.
    {
      "description": "Keep htmx.org pinned to exact versions",
      "matchPackageNames": ["htmx.org"],
      "rangeStrategy": "pin",
    },

    // 7. Wails is critical infrastructure — separate PR, never auto-merge.
    {
      "description": "Wails updates get their own PR (critical dep)",
      "matchPackageNames": ["github.com/wailsapp/wails/v2"],
      "groupName": null,
      "automerge": false,
    },

    // 8. Pin go-webview2 to v1.0.21 — v1.0.22 has a breaking callback
    //    signature change that is incompatible with Wails v2.10.x.
    //    See: https://github.com/wailsapp/wails/issues/4560
    {
      "description": "Disable go-webview2 updates (incompatible with Wails v2)",
      "matchPackageNames": ["github.com/wailsapp/go-webview2"],
      "enabled": false,
    },
  ],

  // ── Vulnerability alerts ───────────────────────────────────
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
  },
}