🔒 feat: promote examples to real presets and cover every ecosystem

.github/workflows/setup-owner.yml

@@ -28,9 +28,9 @@ jobs:
         env:
           OWNER: ${{ steps.owner.outputs.owner }}
         run: |
-          # Point the examples at the new owner's copy of this repo.
-          sed -i "s|ownctrl/supply-chain|${OWNER}/supply-chain|g" examples/*.json
-          echo "Updated examples to use owner: ${OWNER}"
+          # Point the presets at the new owner's copy of this repo.
+          sed -i "s|ownctrl/supply-chain|${OWNER}/supply-chain|g" ./*.json
+          echo "Updated presets to use owner: ${OWNER}"
 
       - name: Update License
         env:
@@ -51,6 +51,6 @@ jobs:
         env:
           OWNER: ${{ steps.owner.outputs.owner }}
         run: |
-          git add examples/ LICENSE .github/workflows/setup-owner.yml
+          git add ./*.json LICENSE .github/workflows/setup-owner.yml
           git commit -m "chore: setup repository owner ($OWNER)"
           git push

.github/workflows/validate.yml

@@ -33,10 +33,11 @@ jobs:
           node-version: 22
 
       # Pinned so CI does not silently execute whatever renovate publishes next.
-      - name: Validate default preset and examples
+      - name: Validate all presets
         env:
           # renovate: datasource=npm depName=renovate
           RENOVATE_VERSION: 44.39.1
         run: |
           npx --yes --package "renovate@${RENOVATE_VERSION}" -- \
-            renovate-config-validator --strict default.json renovate.json examples/*.json
+            renovate-config-validator --strict default.json renovate.json \
+              lockdown.json aggressive.json no-automerge.json

README.md

@@ -208,72 +208,25 @@ LOG_LEVEL=debug renovate --platform=local --dry-run=true
 npx renovate --platform=local --dry-run=true
 ```
 
-## Common overrides
+## Presets
 
-See practical examples in [`examples/`](./examples/) directory.
+Each of these is a ready preset, not a snippet to copy. Reference it directly:
 
-### 🔒 Lockdown Mode (Active Threats)
+| Preset | Reference | What it changes |
+| --- | --- | --- |
+| base | `local>ownctrl/supply-chain` | the policy described above |
+| lockdown | `local>ownctrl/supply-chain:lockdown` | nothing automerges, 14-day npm floor, every update waits for dashboard approval |
+| no-automerge | `local>ownctrl/supply-chain:no-automerge` | automerge off, everything else unchanged |
+| aggressive | `local>ownctrl/supply-chain:aggressive` | any time, no release-age floor, higher PR limit |
 
-For maximum security during active supply chain attacks ([example](./examples/renovate-lockdown.json)):
+Reach for **lockdown** during an active supply-chain incident and **aggressive**
+only when you are certain there is not one.
 
 ```json
-{
-  "extends": ["local>ownctrl/supply-chain"],
-  "prConcurrentLimit": 2,
-  "dependencyDashboardApproval": true,
-  "packageRules": [
-    { "matchDatasources": ["npm"], "minimumReleaseAge": "14 days" },
-    { "matchPackageNames": ["*"], "automerge": false }
-  ]
-}
-```
-
-### 🛡️ Security-Hardened (Recommended)
-
-Balanced security without too much friction ([example](./examples/renovate-security-hardened.json)):
-
-```json
-{
-  "extends": ["local>ownctrl/supply-chain"],
-  "packageRules": [
-    { "matchDepTypes": ["dependencies"], "automerge": false }
-  ]
-}
+{ "extends": ["local>ownctrl/supply-chain:lockdown"] }
 ```
 
-### More aggressive updates
-
-For non-critical projects where you want faster updates ([example](./examples/renovate-aggressive.json)):
-
-```json
-{
-  "extends": ["local>ownctrl/supply-chain"],
-  "schedule": ["at any time"],
-  "prConcurrentLimit": 10,
-  "minimumReleaseAge": null,
-  "packageRules": [
-    { "matchDatasources": ["npm"], "minimumReleaseAge": null }
-  ]
-}
-```
-
-⚠️ **Warning**: Not recommended during active supply chain threats!
-
-### Disable automerge completely
-
-For critical projects requiring manual review ([example](./examples/renovate-no-automerge.json)):
-
-```json
-{
-  "extends": ["local>ownctrl/supply-chain"],
-  "packageRules": [
-    {
-      "matchPackageNames": ["*"],
-      "automerge": false
-    }
-  ]
-}
-```
+Sub-presets extend the base themselves, so you do not list both.
 
 ### Custom timezone
 

examples/renovate-aggressive.json → aggressive.json

@@ -1,14 +1,20 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "description": "Example: More aggressive updates",
-  "extends": ["local>ownctrl/supply-chain"],
-  "schedule": ["at any time"],
+  "description": "Low-friction: updates any time, no release-age floor, higher PR limit. Not for use during an active supply-chain incident.",
+  "extends": [
+    "local>ownctrl/supply-chain"
+  ],
+  "schedule": [
+    "at any time"
+  ],
   "prConcurrentLimit": 10,
   "minimumReleaseAge": null,
   "packageRules": [
     {
       "description": "Top-level minimumReleaseAge cannot lift the inherited npm rule -- a packageRule outranks it, so drop the floor here too",
-      "matchDatasources": ["npm"],
+      "matchDatasources": [
+        "npm"
+      ],
       "minimumReleaseAge": null
     }
   ]

default.json

@@ -50,19 +50,7 @@
       "pinDigests": true
     },
     {
-      "description": "Group all non-major updates together",
-      "matchManagers": [
-        "npm",
-        "bun",
-        "bun-version",
-        "deno",
-        "cargo",
-        "docker",
-        "github-actions",
-        "nix",
-        "terraform",
-        "ansible"
-      ],
+      "description": "Group all non-major updates together, in every ecosystem. Per-language rules below split specific ones back out.",
       "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
       "groupName": "all non-major updates"
     },
@@ -144,6 +132,60 @@
       "groupName": "Deno",
       "separateMinorPatch": false
     },
+    {
+      "description": "Go: group together",
+      "matchManagers": ["gomod"],
+      "groupName": "Go",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "Python: group together",
+      "matchManagers": ["pip_requirements", "pip-compile", "poetry", "pep621", "pipenv", "setup-cfg"],
+      "groupName": "Python",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "JVM: group together",
+      "matchManagers": ["gradle", "gradle-wrapper", "maven", "maven-wrapper", "sbt"],
+      "groupName": "JVM",
+      "separateMinorPatch": false
+    },
+    {
+      "description": ".NET: group together",
+      "matchManagers": ["nuget"],
+      "groupName": ".NET",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "PHP: group together",
+      "matchManagers": ["composer"],
+      "groupName": "PHP",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "Ruby: group together",
+      "matchManagers": ["bundler"],
+      "groupName": "Ruby",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "Dart: group together",
+      "matchManagers": ["pub"],
+      "groupName": "Dart",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "Swift: group together",
+      "matchManagers": ["swift", "cocoapods"],
+      "groupName": "Swift",
+      "separateMinorPatch": false
+    },
+    {
+      "description": "Kubernetes: group together",
+      "matchManagers": ["kubernetes", "helmv3", "helm-values", "helm-requirements", "helmfile", "flux", "argocd"],
+      "groupName": "Kubernetes",
+      "separateMinorPatch": false
+    },
     {
       "description": "Rust: Group cargo crates together",
       "matchManagers": ["cargo"],