From 6c55cafb5fe1fe0dcfbae62fad342ac5968dfc85 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Thu, 10 Sep 2026 00:12:45 -0400
Subject: [PATCH 1/2] chore: swap Dependabot for Renovate on the shared policy

Dependabot's version updates opened 27 pull requests here since July and
none merged, while every other datum-cloud repository takes dependency
updates from Renovate under the org's shared policy. Renovate had never
been onboarded on this repository, so add the standard renovate.json
that extends the shared config and remove the Dependabot config. One bot
owns dependency pull requests; Dependabot alerts are unaffected.

Claude-Session: https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq
---
 .github/dependabot.yml | 18 ------------------
 renovate.json          |  6 ++++++
 2 files changed, 6 insertions(+), 18 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 renovate.json

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 867e26d..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    ignore:
-      - dependency-name: "@backstage/*"
-    groups:
-      minor-and-patch:
-        update-types:
-          - minor
-          - patch
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..0b03488
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>datum-cloud/.github:renovate-config"
+  ]
+}

From 06a234319f7e35c13276d2d0d37b27548108fbc2 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Thu, 10 Sep 2026 13:44:43 -0400
Subject: [PATCH 2/2] chore: group Backstage packages into one update

The Backstage packages move as a set. A release bumps every @backstage/*
package to matching versions, and the framework does not support running
one at a version the rest are not. Bumping a single package on its own
leaves an install that does not resolve.

Dependabot handled this by ignoring @backstage/* outright, which also
meant no advisory for a Backstage package ever reached anyone. Grouping
keeps the packages in lockstep and still lets a security advisory open a
pull request, now covering the whole set rather than one member of it.

Routine minor and patch updates need no grouping rule here. The shared
policy holds them on the dependency dashboard until someone asks, so
they open no pull requests to group.

Claude-Session: https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq
---
 renovate.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/renovate.json b/renovate.json
index 0b03488..4666f90 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,11 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "local>datum-cloud/.github:renovate-config"
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": ["@backstage/**"],
+      "groupName": "backstage"
+    }
   ]
 }