Add shared Renovate organization preset

README.md

@@ -141,3 +141,29 @@ graph, which is disabled here; that reusable workflow is validated by
 actionlint and should be exercised by a caller repository with the graph
 enabled. Scorecard runs on PRs and on pushes to the default branch because the
 upstream action only accepts the default branch for push events.
+
+## Renovate organization preset
+
+Repositories opt in by adding a `renovate.json` file:
+
+```json
+{
+  "extends": ["github>AgentsKit-io/.github"]
+}
+```
+
+The preset schedules updates weekly, groups npm development patch/minor
+updates and GitHub Actions, and groups production runtime patch/minor updates
+for human review. It enables platform automerge only for development
+patch/minor and GitHub Actions digest/patch/minor updates, so GitHub's required
+checks must pass first. Major updates stay separate and never automerge.
+GitHub Actions are pinned to commit digests with release comments. A three-day
+minimum release age applies to npm updates. npm workspaces and pnpm workspaces
+remain discovered from their package manifests and lockfiles; no manager or
+workspace paths are hard-coded. The preset widens runtime dependency ranges
+for library packages instead of pinning published runtime dependencies.
+
+When migrating a repository from Dependabot, add `renovate.json` and remove
+the version-update entries in `.github/dependabot.yml` in the **same PR**.
+Keep Dependabot security alerts enabled; they are separate from Dependabot
+version update configuration.

default.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "schedule": ["on monday"],
+  "timezone": "America/Sao_Paulo",
+  "dependencyDashboard": true,
+  "separateMajorMinor": true,
+  "pinDigests": true,
+  "packageRules": [
+    {
+      "description": "Group npm development dependency patch and minor updates; automerge after platform checks pass",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["devDependencies"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "Development dependencies (patch and minor)",
+      "automerge": true,
+      "platformAutomerge": true
+    },
+    {
+      "description": "Group production runtime patch and minor updates for human review",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["dependencies"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "Production dependencies (patch and minor)",
+      "automerge": false,
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Wait a few days after npm releases before proposing development dependency updates",
+      "matchManagers": ["npm"],
+      "minimumReleaseAge": "3 days"
+    },
+    {
+      "description": "Widen runtime dependency ranges rather than pinning published library dependencies",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["dependencies"],
+      "rangeStrategy": "widen"
+    },
+    {
+      "description": "Group safe GitHub Actions updates and let GitHub merge after required checks pass",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["digest", "patch", "minor"],
+      "groupName": "GitHub Actions",
+      "automerge": true,
+      "platformAutomerge": true
+    },
+    {
+      "description": "Keep major updates separate and require human review",
+      "matchUpdateTypes": ["major"],
+      "automerge": false
+    }
+  ]
+}