From 58f46ec6362bb787ee38de645314b0e28c3307c4 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 26 Oct 2026 09:50:53 +1100
Subject: [PATCH 1/3] chore(renovate): batch updates weekly and merge tooling
 once CI passes

Updates now open on Mondays only.
Dev dependencies, GitHub Actions, Biome and lockfile maintenance automerge.
Runtime dependencies, climate-ref, the interpreter, images and majors still wait for a review.
---
 renovate.json | 70 +++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 57 insertions(+), 13 deletions(-)

diff --git a/renovate.json b/renovate.json
index 1dbee84b..d161ea6a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -5,44 +5,88 @@
     ":dependencyDashboard",
     ":semanticCommits"
   ],
+  "description": [
+    "Tooling and lockfile refreshes merge themselves once CI is green.",
+    "Runtime libraries, climate-ref, the interpreter, images and every major wait for a review."
+  ],
   "timezone": "Australia/Melbourne",
   "dependencyDashboardTitle": "Renovate Dependency Dashboard",
   "labels": ["dependencies"],
   "minimumReleaseAge": "3 days",
   "internalChecksFilter": "strict",
-  "prConcurrentLimit": 5,
-  "prHourlyLimit": 2,
+  "prConcurrentLimit": 10,
+  "prHourlyLimit": 0,
+  "schedule": ["on monday"],
+  "platformAutomerge": false,
+  "automergeType": "pr",
   "lockFileMaintenance": {
     "enabled": true,
-    "schedule": ["before 6am on monday"]
+    "schedule": ["on monday"],
+    "automerge": true
   },
   "vulnerabilityAlerts": {
     "enabled": true,
-    "labels": ["dependencies", "security"]
+    "labels": ["dependencies", "security"],
+    "schedule": ["at any time"],
+    "minimumReleaseAge": null,
+    "groupName": null
   },
   "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
-      "description": "Label frontend (npm) updates",
       "matchManagers": ["npm"],
       "addLabels": ["frontend"]
     },
     {
-      "description": "Label backend (uv / Python) updates",
-      "matchManagers": ["pep621"],
+      "matchManagers": ["pep621", "pyenv"],
       "addLabels": ["backend"]
     },
     {
-      "description": "Group non-major frontend updates into a single PR",
       "matchManagers": ["npm"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "frontend non-major"
+      "groupName": "frontend dependencies"
+    },
+    {
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["devDependencies"],
+      "groupName": "frontend dev tooling",
+      "automerge": true
     },
     {
-      "description": "Group non-major backend updates into a single PR",
       "matchManagers": ["pep621"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "backend non-major"
+      "groupName": "backend dependencies"
+    },
+    {
+      "matchManagers": ["pep621"],
+      "matchDepTypes": ["dependency-groups"],
+      "groupName": "backend dev tooling",
+      "automerge": true
+    },
+    {
+      "description": "The core library sets what the API can serve, so it is reviewed on its own",
+      "matchDepNames": ["climate-ref"],
+      "groupName": "climate-ref",
+      "schedule": ["at any time"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "ci tooling",
+      "automerge": true
+    },
+    {
+      "description": "Biome is pinned in both package.json and the CI workflow, so they move together",
+      "matchDepNames": ["@biomejs/biome", "biome"],
+      "groupName": "ci tooling",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "groupName": "container images"
+    },
+    {
+      "description": "A major is never hidden inside a batch and never merges itself",
+      "matchUpdateTypes": ["major"],
+      "groupName": null,
+      "automerge": false
     }
   ]
 }

From a5d96f22ffaf79a6e014ae5c98c23b9279883283 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 26 Oct 2026 09:51:28 +1100
Subject: [PATCH 2/3] docs(changelog): add 160 fragment

---
 changelog/160.trivial.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog/160.trivial.md

diff --git a/changelog/160.trivial.md b/changelog/160.trivial.md
new file mode 100644
index 00000000..2003d29a
--- /dev/null
+++ b/changelog/160.trivial.md
@@ -0,0 +1 @@
+Renovate now batches updates weekly and merges dev tooling, GitHub Actions and lockfile updates once CI passes.

From 076b9168b71023b02201b901c8227a40421ff802 Mon Sep 17 00:00:00 2001
From: Jared Lewis <jared@jared.kiwi.nz>
Date: Mon, 26 Oct 2026 09:56:22 +1100
Subject: [PATCH 3/3] ci: add a ci-pass job for the ruleset to require

It fails when any test, lint or build job fails or is cancelled.
Requiring this one check keeps the ruleset stable as jobs are added or renamed.
---
 .github/workflows/ci.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da7140bd..237679eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -131,3 +131,16 @@ jobs:
         BASE_SHA: ${{ github.event.pull_request.base.sha }}
       run: |
         scripts/perf-compare.sh "$BASE_SHA"
+
+  # The only check the ruleset requires, so jobs can change without touching repo settings.
+  ci-pass:
+    if: always()
+    needs:
+      - check-changelog
+      - frontend
+      - backend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if a required job failed or was cancelled
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1