chore: inline self-contained house Renovate config

[bakerboy448]

Replace prior Renovate config with full inlined house config (public presets only, self-contained — no cross-repo refs). Validated with renovate-config-validator.

Summary by CodeRabbit

• Chores
  • Updated dependency management configuration. Security vulnerability updates will now automatically merge when CI passes. Major version updates require review and are labeled accordingly. Lock file maintenance runs on a consistent weekly schedule.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 37989631-8bfb-4ae0-bc6f-fc5b4217b291

📥 Commits

Reviewing files that changed from the base of the PR and between f14d14a and d5d3c64.

📒 Files selected for processing (1)

• renovate.json

---

Walkthrough

renovate.json is expanded from a minimal extends: ["config:recommended"] into a full configuration. It adds scheduling, PR throughput and concurrency limits, automerge controls (disabled globally, enabled for vulnerability alerts and certain update types), packageRules for GitHub Actions and major updates, lockFileMaintenance, and recreateWhen: "auto".

Changes

Renovate Configuration Overhaul

Layer / File(s)	Summary
Global defaults: extends, schedule, PR limits, update strategy renovate.json	Replaces minimal extends with config:best-practices plus presets for dependency dashboard, semantic commits, and vulnerability labels. Sets timezone, schedule, prHourlyLimit, prConcurrentLimit, labels, updateNotScheduled, rebaseWhen, bumpVersion, separateMajorMinor, separateMinorPatch, automerge: false, and platformAutomerge: false.
Vulnerability alerts and packageRules automerge logic renovate.json	Adds vulnerabilityAlerts block with security label and automerge enabled. Introduces packageRules to group and automerge GitHub Actions minor/patch/digest updates on CI green; hold GitHub Actions majors with review-required label; hold all other manager majors with major and review-required labels.
Lock file maintenance and recreateWhen renovate.json	Enables lockFileMaintenance on the Sunday 6am schedule with automergeType: "branch"; sets recreateWhen: "auto".

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is minimal but meaningful, explaining the purpose of replacing Renovate config with an inlined, self-contained version. However, it does not follow the repository's description template, which specifies required sections like Summary, Changes checklist, and Checklist items.	Restructure the description to match the template: add a Summary section, complete the Changes checklist (marking relevant items), and address all Checklist items including testing and credential verification.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: inlining a self-contained Renovate configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/renovate-inline-config

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}