Meshtastic-Android/.github/renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    ":dependencyDashboard",
    ":semanticCommitTypeAll(chore)",
    ":ignoreModulesAndTests",
    "group:recommended",
    "replacements:all",
    "workarounds:all",
    "helpers:pinGitHubActionDigests"
  ],
  "commitMessageTopic": "{{depName}}",
  "osvVulnerabilityAlerts": true,
  "labels": [
    "dependencies"
  ],
  "git-submodules": {
    "enabled": true
  },
  "bundler": {
    "enabled": true
  },
  "packageRules": [
    {
      "description": "Automerge non-major updates for stable versions",
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "digest"
      ],
      "matchCurrentVersion": "!/^0/",
      "automerge": true
    },
    {
      "description": "Automerge patch updates for unstable (0.x) versions",
      "matchUpdateTypes": [
        "patch",
        "pin",
        "digest"
      ],
      "matchCurrentVersion": "/^0/",
      "automerge": true
    },
    {
      "description": "Automerge pins and digests regardless of version",
      "matchUpdateTypes": [
        "pin",
        "digest"
      ],
      "automerge": true
    },
    {
      "description": "Protobufs bumps: link the upstream compare in the body (the snapshot version carries the commit as -g<sha>; a release maps to its tag). protobufs-bump.yml adds a comment with the merged upstream PRs, the .proto delta and the settings strings that change; the hourly scheduled-updates run regenerates values/schema_strings.xml from whatever pin main has.",
      "matchPackageNames": [
        "org.meshtastic:protobufs"
      ],
      "prBodyNotes": [
        "Upstream: https://github.com/meshtastic/protobufs/compare/{{#if (containsString currentVersion 'SNAPSHOT')}}{{{replace '^.*-g([0-9a-f]+)-SNAPSHOT$' '$1' currentVersion}}}{{else}}v{{{currentVersion}}}{{/if}}...{{#if (containsString newVersion 'SNAPSHOT')}}{{{replace '^.*-g([0-9a-f]+)-SNAPSHOT$' '$1' newVersion}}}{{else}}v{{{newVersion}}}{{/if}} - the `Protobufs Bump` workflow comments with the merged PRs, the `.proto` delta and the settings strings that change; `values/schema_strings.xml` is regenerated by the hourly scheduled-updates run after this merges."
      ]
    },
    {
      "description": "Protobufs: only accept the dot-form snapshot scheme (X.Y.Z.N-g<sha>-SNAPSHOT) or plain releases. Legacy hyphen-SHA snapshots (e.g. 2.7.26-678281c-SNAPSHOT) tokenize their digit-leading SHA as a huge int that outranks the dot-form commit-count in Renovate's maven comparator, so without this constraint Renovate keeps proposing a downgrade to an old snapshot (see PR #6229). The snapshot repo has no delete API; legacy versions auto-prune after 90 days.",
      "matchPackageNames": [
        "org.meshtastic:protobufs"
      ],
      "allowedVersions": "/^\\d+\\.\\d+\\.\\d+(\\.\\d+-g[0-9a-f]+-SNAPSHOT)?$/"
    },
    {
      "description": "Group CMP and the androidx.compose artifacts that track it so Renovate bumps them together (see PR #5180). Every artifact pinned to the `androidx-compose-bom-aligned` catalog ref must be listed here: bumping any one of them rewrites that shared ref, which AndroidCompose.kt's resolutionStrategy force-aligns across the whole androidx.compose group, so an ungrouped artifact silently drags the entire Android Compose stack out of step with CMP (see PR #6651, where a solo ui-text-google-fonts bump broke screenshot preview discovery).",
      "groupName": "compose-multiplatform",
      "matchPackageNames": [
        "/^org\\.jetbrains\\.compose/",
        "androidx.compose.runtime:runtime-tracing",
        "androidx.compose.ui:ui-test-manifest",
        "androidx.compose.material:material",
        "androidx.compose.ui:ui-text-google-fonts"
      ]
    },
    {
      "description": "Restrict sensitive infrastructure to manual minor updates",
      "matchUpdateTypes": [
        "minor"
      ],
      "matchPackageNames": [
        "/^org\\.jetbrains\\.kotlin/",
        "/^org\\.jetbrains\\.kotlinx/",
        "/^org\\.jetbrains\\.compose/",
        "/^com\\.google\\.dagger/",
        "/^androidx\\.hilt/",
        "/^com\\.google\\.protobuf/",
        "/^androidx\\.lifecycle/",
        "/^androidx\\.navigation/",
        "/^androidx\\.datastore/",
        "/^androidx\\.compose\\.material3\\.adaptive/",
        "/^androidx\\.compose\\.material3:material3-adaptive-navigation-suite$/"
      ],
      "automerge": false
    },
    {
      "description": "Disable automerge for major updates (safety net)",
      "matchUpdateTypes": [
        "major"
      ],
      "automerge": false
    },
    {
      "description": "Coordinate the Kotlin-compiler-locked toolchain in one human-reviewed PR. Kotlin, KSP, Mokkery, and the Koin compiler plugin are version-locked to the Kotlin compiler and break when bumped out of lockstep (e.g. Mokkery 3.4.0 and kable 0.43.1 both required Kotlin 2.4.0 — PRs #5750/#5740). Supersedes the built-in group:kotlinMonorepo/group:kspMonorepo for these packages so they land together; automerge stays off so compiler bumps always get a human review plus a green CI build. The `[.:]` after kotlin intentionally excludes org.jetbrains.kotlinx (coroutines/serialization runtime), which is not compiler-locked.",
      "groupName": "kotlin-toolchain",
      "matchManagers": [
        "gradle"
      ],
      "matchPackageNames": [
        "/^org\\.jetbrains\\.kotlin[.:]/",
        "/^com\\.google\\.devtools\\.ksp/",
        "/^dev\\.mokkery/",
        "/^io\\.insert-koin\\.compiler\\.plugin/"
      ],
      "automerge": false
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "description": "Mirror gradle-wrapper.properties bumps into the vendored Gradle distribution URL in the verify-flatpak offline manifest (see PRs #6777/#6782, where a wrapper bump without this file broke both build-flatpak arches). Shares depName 'gradle' with the gradle-wrapper manager so both files update in the same Renovate branch/PR. The sha256 line below the URL cannot be auto-updated (the gradle-version datasource has no digest support and the hosted app disallows postUpgradeTasks); the fail-fast guard in verify-flatpak.yml's generate-sources job holds that PR red until the sha256 is copied from distributionSha256Sum.",
      "managerFilePatterns": [
        "/^scripts/verify-flatpak/desktop-offline\\.yaml$/"
      ],
      "matchStrings": [
        "services\\.gradle\\.org/distributions/gradle-(?<currentValue>\\d+(?:\\.\\d+)*)-bin\\.zip"
      ],
      "depNameTemplate": "gradle",
      "datasourceTemplate": "gradle-version",
      "versioningTemplate": "gradle"
    }
  ]
}