{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  dependencyDashboard: true,
  suppressNotifications: ["prEditedNotification"],
  extends: ["github>astral-sh/renovate-config"],
  labels: ["internal"],
  schedule: ["before 4am on Wednesday"],
  semanticCommits: "disabled",
  separateMajorMinor: false,
  prHourlyLimit: 10,
  enabledManagers: ["github-actions", "pre-commit", "custom.regex"],
  "pre-commit": {
    enabled: true,
  },
  packageRules: [
    // Pin GitHub Actions to immutable SHAs.
    {
      matchDepTypes: ["action"],
      pinDigests: true,
    },
    // Annotate GitHub Actions SHAs with a SemVer version.
    {
      extends: ["helpers:pinGitHubActionDigests"],
      extractVersion: "^(?<version>v?\\d+\\.\\d+\\.\\d+)$",
      versioning: "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$",
    },
    {
      // Group upload/download artifact updates, the versions are dependent
      groupName: "Artifact GitHub Actions dependencies",
      matchManagers: ["github-actions"],
      matchDatasources: ["gitea-tags", "github-tags"],
      matchPackageNames: ["actions/upload-artifact", "actions/download-artifact"],
      description: "Weekly update of artifact-related GitHub Actions dependencies",
    },
    {
      // This package rule disables updates for GitHub runners:
      // we'd only pin them to a specific version
      // if there was a deliberate reason to do so
      groupName: "GitHub runners",
      matchManagers: ["github-actions"],
      matchDatasources: ["github-runners"],
      description: "Disable PRs updating GitHub runners (e.g. 'runs-on: macos-14')",
      enabled: false,
    },
    {
      groupName: "prek dependencies",
      matchManagers: ["pre-commit"],
      description: "Weekly update of prek dependencies",
    },
    {
      matchManagers: ["custom.regex"],
      matchDepNames: ["maturin"],
      commitMessageTopic: "maturin",
    },
  ],
  customManagers: [
    // Maturin version used in maturin-action
    {
      customType: "regex",
      managerFilePatterns: [
        "/.github/workflows/build-binaries\\.yml$/",
      ],
      matchStrings: ["maturin-version: (?<currentValue>v\\d+\\.\\d+\\.\\d+)"],
      depNameTemplate: "maturin",
      packageNameTemplate: "PyO3/maturin",
      datasourceTemplate: "github-releases",
    },
  ],
  vulnerabilityAlerts: {
    commitMessageSuffix: "",
    labels: ["internal", "security"],
  },
}
