From a0158de7cf7e2e8dd6d1ccc5126143d44e98206b Mon Sep 17 00:00:00 2001
From: Nick Josevski <nick.josevski@octopus.com>
Date: Tue, 18 Aug 2026 17:43:04 +1000
Subject: [PATCH] Add a repo-level Renovate configuration

Group the SDK families and the test dependencies so each lands as one PR.
Advisory updates run on their own schedule and carry a security label.
Majors queue on the dependency dashboard for approval. Targets main only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 renovate.json | 108 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 107 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 7190a60b64..c7a43fadf9 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,3 +1,109 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard"
+  ],
+  "timezone": "Australia/Brisbane",
+  "schedule": [
+    "before 6am on monday"
+  ],
+  "labels": [
+    "dependencies"
+  ],
+  "minimumReleaseAge": "3 days",
+  "ignorePaths": [
+    "source/Calamari.Tests/Fixtures/**",
+    "publish/**",
+    "**/bin/**",
+    "**/obj/**"
+  ],
+  "vulnerabilityAlerts": {
+    "description": "Advisories jump the weekly queue and carry their own label",
+    "enabled": true,
+    "labels": [
+      "dependencies",
+      "security"
+    ],
+    "schedule": [
+      "at any time"
+    ],
+    "minimumReleaseAge": null
+  },
+  "osvVulnerabilityAlerts": true,
+  "packageRules": [
+    {
+      "description": "Majors wait for a tick on the dependency dashboard",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "One PR for the AWS SDK, which versions its packages in lockstep",
+      "matchPackageNames": [
+        "AWSSDK.**"
+      ],
+      "groupName": "AWS SDK"
+    },
+    {
+      "description": "One PR for the Azure SDK and the identity library it depends on",
+      "matchPackageNames": [
+        "Azure.**",
+        "Microsoft.Identity.Client"
+      ],
+      "groupName": "Azure SDK"
+    },
+    {
+      "description": "One PR for the NuGet client libraries",
+      "matchPackageNames": [
+        "NuGet.**"
+      ],
+      "groupName": "NuGet client"
+    },
+    {
+      "description": "One PR for test-only dependencies",
+      "matchPackageNames": [
+        "Assent",
+        "FluentAssertions",
+        "Microsoft.Extensions.TimeProvider.Testing",
+        "Microsoft.NET.Test.Sdk",
+        "NSubstitute",
+        "NUnit",
+        "NUnit3TestAdapter",
+        "TeamCity.VSTest.TestAdapter",
+        "TestStack.BDDfy",
+        "WireMock.Net",
+        "nunit"
+      ],
+      "groupName": "test dependencies"
+    },
+    {
+      "description": "One PR for Serilog and its sinks",
+      "matchPackageNames": [
+        "Serilog",
+        "Serilog.**"
+      ],
+      "groupName": "Serilog"
+    },
+    {
+      "description": "One PR for Octopus packages. Most resolve from feedz.io, so they stay quiet until the runner has credentials for that feed",
+      "matchPackageNames": [
+        "Octopus.**",
+        "Octostache"
+      ],
+      "groupName": "Octopus packages"
+    },
+    {
+      "description": "Workflow actions move slowly and are pinned by digest to match the existing pin on renovatebot/github-action",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "groupName": "GitHub Actions",
+      "pinDigests": true,
+      "schedule": [
+        "before 6am on the first day of the month"
+      ]
+    }
+  ]
 }