renovate

Defaults

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices",
    "security:openssf-scorecard",
    "customManagers:githubActionsVersions"
  ],
  "timezone": "Europe/London",
  "reviewers": ["alunduil"],
  "labels": ["dependencies"],
  "pre-commit": { "enabled": true }
}

• This block is identical in every repo and is a standing candidate for a shared preset (github>alunduil/renovate-config, a default.json); Renovate also checks <owner>/renovate-config when onboarding a new repo. Until that repo exists, keep the block inline and change it everywhere at once.
• Omit baseBranchPatterns. It is auto-detected, and hard-coding it is the one field that differs per repo (main vs master) — the thing that would block sharing.
• Omit schedule unless a repo wants batching. With a bake period the PR is already delayed, and Renovate's default prHourlyLimit of 2 rate-limits the rest.
• packageRules and customManagers are mergeable: true, so preset arrays concatenate with a repo's own rather than replacing them. labels and reviewers are not mergeable — setting them in a repo replaces the inherited value. addLabels merges and appends; labels in a shared preset is dropped wholesale by the first repo setting its own.
• labels — default [], so Renovate labels nothing without this. A stale sweep exempting Renovate PRs by label depends on it: closing a Renovate PR tells Renovate the version is unwanted and it will not re-offer it. vulnerabilityAlerts takes no labels.
• reviewers — without it, Renovate PRs land silent. Use assignees instead for a creation-time ping with no rebase notifications.
• pre-commit: { enabled: true } — opt-in manager; enable unconditionally. No-op without .pre-commit-config.yaml; replaces pre-commit.ci where the file exists.
• config:best-practices = config:recommended + docker:pinDigests + helpers:pinGitHubActionDigests + :configMigration + :pinDevDependencies + abandonments:recommended + security:minimumReleaseAgeNpm + :maintainLockFilesWeekly. It does not include OpenSSF scorecard; that is security:openssf-scorecard, which adds a badge column to PR bodies.