From ba99dc791528fb0cc5e90c453136d61ce4dc0bca Mon Sep 17 00:00:00 2001
From: wadakatu <72595463+wadakatu@users.noreply.github.com>
Date: Thu, 4 Jun 2026 02:03:35 +0900
Subject: [PATCH] chore(renovate): adopt config:best-practices and pin actions
 to SHA

- switch preset config:recommended -> config:best-practices
  (pins all GitHub Actions to SHA digests, enables config migration
  and abandoned-package detection)
- add minimumReleaseAge: "7 days" cool-down before automerge to dodge
  yanked / tampered releases
- restrict GitHub Actions automerge to minor/patch/digest updates so
  major action bumps require manual review
- disable Renovate for the example's path-linked self reference
---
 renovate.json | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/renovate.json b/renovate.json
index 8c3c0e1..4276dce 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,15 +1,22 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:best-practices"
   ],
   "labels": ["dependencies"],
-  "schedule": ["before 9am on Monday"],
   "timezone": "Asia/Tokyo",
+  "schedule": ["before 9am on Monday"],
+  "minimumReleaseAge": "7 days",
   "packageRules": [
     {
-      "description": "Group GitHub Actions updates",
+      "description": "Skip the example's path-linked self reference (resolved from the working tree, not Packagist)",
+      "matchPackageNames": ["studio-design/openapi-contract-testing"],
+      "enabled": false
+    },
+    {
+      "description": "Automerge GitHub Actions digest + minor/patch bumps; majors stay manual review",
       "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest"],
       "groupName": "GitHub Actions",
       "automerge": true
     },