"description":"Cargo dependencies, the Rust toolchain pin, prek (via mise) and the workflows' own actions merge by pushing to main, without a pull request. ci.yml runs on `push: [\"**\"]`, so the Renovate branch itself is compiled, linted with `clippy -D warnings` and unit-tested first; a failure leaves the branch red and Renovate raises a pull request instead of merging.",
"description":"The release image's base (Dockerfile). Gated by ci.yml's docker-build job, which builds the image exactly as Publish does but with `push: false`, and which only runs when the Dockerfile actually changed.",
"description":"Local development service images under etc/services/** - the homeservers and LLM backends that `just services-start` brings up. They are never part of a shipped artifact and CI does not run them, so the justification here is blast radius rather than validation: the worst case is a broken local development stack, fixed by pinning back.",
"matchManagers":[
"docker-compose"
],
"matchFileNames":[
"etc/services/**"
],
"matchUpdateTypes":[
"minor",
"patch",
"digest"
],
"automerge":true,
"automergeType":"branch",
"platformAutomerge":false
},
{
"description":"Major updates always get a pull request and a human. This is deliberately the last rule so that it overrides the automerge rules above for every manager.",