mikimatsub/.github

Default community health files and shared tooling config for mikimatsub's projects. GitHub recognizes this special repo and applies its contents as fallback defaults across every other repo in the namespace.

What's in here

File	Purpose	Inherited by
renovate-config.json	Central Renovate config — dependency-update automation rules	Any repo that adds {"extends": ["local>mikimatsub/.github:renovate-config"]} to its own renovate.json

Renovate central config

The single source of truth for how Renovate behaves across every repo. Built on top of the upstream config:best-practices preset, which composes:

• config:recommended — Renovate's vetted defaults
• docker:pinDigests — pin Docker images by SHA256, not by tag
• helpers:pinGitHubActionDigests — same idea for GitHub Actions
• :configMigration — auto-PRs for outdated Renovate config syntax
• :pinDevDependencies — pin devDeps to exact versions
• abandonments:recommended — flag dependencies that have stopped receiving updates
• security:minimumReleaseAgeNpm — don't merge npm packages younger than 3 days (supply-chain attack defense)
• :maintainLockFilesWeekly — refresh package-lock.json weekly to pick up transitive security fixes

Plus a few additions:

• Schedule — Monday mornings only, so PRs land predictably
• Concurrency cap — never more than 5 open Renovate PRs per repo

What's not here yet

• No automerge rules. New repos run with manual merging until the maintainer is comfortable with Renovate's classifications. Once trust is established (~2-4 weeks), automerge for patch + dev-deps can be added here.
• No labels. Labels are repo-specific (they need to exist in each repo). A future iteration may add them via per-repo renovate.json overrides.
• No package rules. Start clean; add patterns as they emerge.

Inheriting from this config

Any repo wanting these rules adds a single file at the repo root:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>mikimatsub/.github:renovate-config"
  ]
}

That's it. The repo inherits everything in renovate-config.json, including future updates pushed here.

Activating Renovate on a repo

1. Add the renovate.json shown above to the target repo
2. Install the Renovate GitHub App on the target repo (one-time per repo)
3. Renovate runs an initial onboarding pass; once that's accepted, weekly scans begin automatically