From b4b21c1b2eaff6ac9883e5e13c9bd4dd188bdae9 Mon Sep 17 00:00:00 2001
From: ancplua <anfh22@outlook.com>
Date: Mon, 6 Jul 2026 22:40:00 +0200
Subject: [PATCH] deps: add 3-day release-age cooldown, exempt first-party

Harden the shared Renovate baseline against supply-chain risk. The preset
auto-merges a lot (patch, digest, npm devDep minor, and ~8 grouped families),
so a freshly-published compromised or broken version could auto-merge within
minutes. config:best-practices does not set a cooldown on its own.

- minimumReleaseAge: "3 days" + internalChecksFilter: "strict" so a bad
  upstream release has time to be yanked before it can auto-merge.
- First-party exemption (ANcpLua.* + Qyl.*, nuget): minimumReleaseAge "0"
  so our own releases still propagate across the fleet immediately.

Validated with renovate-config-validator: "Config validated successfully".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 default.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/default.json b/default.json
index c52a76e..964e87f 100644
--- a/default.json
+++ b/default.json
@@ -15,6 +15,8 @@
   "platformAutomerge": true,
   "prHourlyLimit": 2,
   "prConcurrentLimit": 5,
+  "minimumReleaseAge": "3 days",
+  "internalChecksFilter": "strict",
   "packageRules": [
     {
       "description": "Hygiene: digest pins + lockfile maintenance — content-locking, automerge always",
@@ -87,6 +89,17 @@
       "automerge": true,
       "automergeType": "pr"
     },
+    {
+      "description": "First-party (ANcpLua.* + Qyl.*) — exempt from the release-age cooldown; we publish these and want fleet propagation to be immediate, not delayed 3 days",
+      "matchDatasources": [
+        "nuget"
+      ],
+      "matchPackageNames": [
+        "/^ANcpLua\\./",
+        "/^Qyl\\./"
+      ],
+      "minimumReleaseAge": "0"
+    },
     {
       "description": "Roslyn analyzers + reference assemblies",
       "matchPackageNames": [