From f8a8715829d105e6e0c0b521e5716a39281c9a68 Mon Sep 17 00:00:00 2001
From: EmersonBraun <emersonfbraun@gmail.com>
Date: Fri, 2 Oct 2026 21:44:30 -0300
Subject: [PATCH] Add shared Renovate preset

---
 README.md    | 33 ++++++++++++++++++++++++++++++--
 default.json | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+), 2 deletions(-)
 create mode 100644 default.json

diff --git a/README.md b/README.md
index 728210a..fc5652f 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,31 @@
-# .github
-Shared reusable workflows and dependency-update presets for AgentsKit-io repositories
+# AgentsKit shared GitHub configuration
+
+This public repository provides reusable security checks and an organization
+Renovate preset. Each calling repository keeps its own triggers, build matrix,
+release workflow, and package-specific checks.
+
+## Renovate organization preset
+
+Repositories opt in by adding a `renovate.json` file:
+
+```json
+{
+  "extends": ["github>AgentsKit-io/.github"]
+}
+```
+
+The preset schedules updates weekly, groups npm development patch/minor
+updates and GitHub Actions, and groups production runtime patch/minor updates
+for human review. It enables platform automerge only for development
+patch/minor and GitHub Actions digest/patch/minor updates, so GitHub's required
+checks must pass first. Major updates stay separate and never automerge.
+GitHub Actions are pinned to commit digests with release comments. A three-day
+minimum release age applies to npm updates. npm workspaces and pnpm workspaces
+remain discovered from their package manifests and lockfiles; no manager or
+workspace paths are hard-coded. The preset widens runtime dependency ranges
+for library packages instead of pinning published runtime dependencies.
+
+When migrating a repository from Dependabot, add `renovate.json` and remove
+the version-update entries in `.github/dependabot.yml` in the **same PR**.
+Keep Dependabot security alerts enabled; they are separate from Dependabot
+version update configuration.
diff --git a/default.json b/default.json
new file mode 100644
index 0000000..2dcc10c
--- /dev/null
+++ b/default.json
@@ -0,0 +1,53 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "schedule": ["on monday"],
+  "timezone": "America/Sao_Paulo",
+  "dependencyDashboard": true,
+  "separateMajorMinor": true,
+  "pinDigests": true,
+  "packageRules": [
+    {
+      "description": "Group npm development dependency patch and minor updates; automerge after platform checks pass",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["devDependencies"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "Development dependencies (patch and minor)",
+      "automerge": true,
+      "platformAutomerge": true
+    },
+    {
+      "description": "Group production runtime patch and minor updates for human review",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["dependencies"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "Production dependencies (patch and minor)",
+      "automerge": false,
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Wait a few days after npm releases before proposing development dependency updates",
+      "matchManagers": ["npm"],
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Widen runtime dependency ranges rather than pinning published library dependencies",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["dependencies"],
+      "rangeStrategy": "widen"
+    },
+    {
+      "description": "Group safe GitHub Actions updates and let GitHub merge after required checks pass",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["digest", "patch", "minor"],
+      "groupName": "GitHub Actions",
+      "automerge": true,
+      "platformAutomerge": true
+    },
+    {
+      "description": "Keep major updates separate and require human review",
+      "matchUpdateTypes": ["major"],
+      "automerge": false
+    }
+  ]
+}