feat: add renovate.json configuration

renovate.json

@@ -0,0 +1,105 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base"],
+
+  "platform": "gitea",
+  "endpoint": "https://git.bryanmail.net",
+
+  "repositories": [
+    "homelab/compose-files"
+  ],
+
+  "timezone": "America/Los_Angeles",
+  "schedule": ["after 2am and before 6am every weekday"],
+
+  "labels": ["renovate"],
+  "assignees": ["admin"],
+  "reviewers": ["admin"],
+
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 2,
+  "branchConcurrentLimit": 10,
+
+  "commitMessagePrefix": "chore(deps):",
+  "semanticCommits": "enabled",
+
+  "packageRules": [
+    {
+      "description": "Auto-merge patch updates for low-risk app stacks",
+      "matchFileNames": [
+        "mealie/**",
+        "vaultwarden/**",
+        "maintenance/**",
+        "meshcentral/**"
+      ],
+      "matchUpdateTypes": ["patch"],
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "merge"
+    },
+    {
+      "description": "Auto-merge minor+patch for media stack (Plex/Radarr/Sonarr update frequently)",
+      "matchFileNames": ["media/**"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "merge"
+    },
+    {
+      "description": "NEVER auto-merge bootstrap/critical stacks - manual review required",
+      "matchFileNames": [
+        "traefik.yaml",
+        "traefik.env",
+        "auth.yaml",
+        "auth.env",
+        "postgresql.yaml",
+        "woodpecker.yaml",
+        "git.yaml"
+      ],
+      "automerge": false,
+      "labels": ["renovate", "high-risk"],
+      "reviewers": ["admin"]
+    },
+    {
+      "description": "Never auto-merge major version bumps for anything",
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "labels": ["renovate", "major-update"]
+    },
+    {
+      "description": "Group all immich updates together (server+microservices must stay in sync)",
+      "matchFileNames": ["immich/**"],
+      "groupName": "immich",
+      "automerge": false,
+      "labels": ["renovate", "immich"]
+    },
+    {
+      "description": "Group all AI stack updates together",
+      "matchFileNames": ["ai.yaml"],
+      "groupName": "ai-stack",
+      "automerge": false,
+      "labels": ["renovate", "ai"]
+    },
+    {
+      "description": "Pin digest updates silently (SHA pinning) - auto-merge",
+      "matchUpdateTypes": ["digest"],
+      "automerge": true,
+      "automergeType": "pr"
+    }
+  ],
+
+  "docker-compose": {
+    "fileMatch": [
+      "(^|/)docker-compose\\.ya?ml$",
+      "(^|/)[a-z0-9-]+\\.ya?ml$"
+    ]
+  },
+
+  "ignorePaths": [
+    "deploy/**",
+    "secrets/**",
+    ".woodpecker/**",
+    "*.env",
+    "*.env.example"
+  ]
+}