{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],

  "timezone": "America/Los_Angeles",
  "schedule": ["after 2am and before 6am every weekday"],

  "labels": ["renovate"],
  "assignees": ["admin"],
  "reviewers": ["admin"],

  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "branchConcurrentLimit": 10,

  "commitMessagePrefix": "chore(deps):",
  "semanticCommits": "enabled",

  "packageRules": [
    {
      "description": "Auto-merge patch updates for low-risk app stacks",
      "matchFileNames": [
        "mealie/**",
        "vaultwarden/**",
        "maintenance/**",
        "meshcentral/**"
      ],
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "merge"
    },
    {
      "description": "Auto-merge minor+patch for media stack (Plex/Radarr/Sonarr update frequently)",
      "matchFileNames": ["media/**"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true,
      "automergeType": "pr",
      "automergeStrategy": "merge"
    },
    {
      "description": "NEVER auto-merge bootstrap/critical stacks - manual review required",
      "matchFileNames": [
        "traefik.yaml",
        "traefik.env",
        "auth.yaml",
        "auth.env",
        "postgresql.yaml",
        "woodpecker.yaml",
        "git.yaml"
      ],
      "automerge": false,
      "labels": ["renovate", "high-risk"],
      "reviewers": ["admin"]
    },
    {
      "description": "Never auto-merge major version bumps for anything",
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "labels": ["renovate", "major-update"]
    },
    {
      "description": "Group all immich updates together (server+microservices must stay in sync)",
      "matchFileNames": ["immich/**"],
      "groupName": "immich",
      "automerge": false,
      "labels": ["renovate", "immich"]
    },
    {
      "description": "Group all AI stack updates together",
      "matchFileNames": ["ai.yaml"],
      "groupName": "ai-stack",
      "automerge": false,
      "labels": ["renovate", "ai"]
    },
    {
      "description": "Pin digest updates silently (SHA pinning) - auto-merge",
      "matchUpdateTypes": ["digest"],
      "automerge": true,
      "automergeType": "pr"
    }
  ],

  "docker-compose": {
    "fileMatch": [
      "(^|/)docker-compose\\.ya?ml$",
      "(^|/)[a-z0-9-]+\\.ya?ml$"
    ]
  },

  "woodpecker": {
    "enabled": false
  },

  "ignorePaths": [
    "deploy/**",
    "secrets/**",
    ".woodpecker/**",
    "*.env",
    "*.env.example"
  ]
}