renovate-config-generator

by charlie-morrison

Install this Skill

curl -fsSL -o renovate-config-generator.zip https://skill.seembox.com/api/v1/skills/renovate-config-generator/download && unzip renovate-config-generator.zip

Download renovate-config-generator.zip

SKILL.md About

---
name: renovate-config-generator
description: Generate Renovate Bot configurations for automated dependency updates — analyze project dependencies, create grouping rules, schedule policies, automerge rules, and custom manager definitions.
metadata:
  tags: ["renovate", "dependencies", "automation", "devops", "npm", "docker", "terraform", "ci-cd", "updates"]
---

# Renovate Config Generator

Analyze a project's dependency landscape and generate a production-ready Renovate Bot configuration. Handles monorepos, custom registries, grouping strategies, automerge policies, schedule windows, and custom managers — so dependency updates flow smoothly instead of drowning your team in PRs.

Use when: "set up renovate", "configure dependency updates", "generate renovate config", "automate dependency management", "too many renovate PRs", "renovate is noisy", or when onboarding a new repo to Renovate.

## Prerequisites

```bash
# Check for existing Renovate config
ls renovate.json renovate.json5 .renovaterc .renovaterc.json .github/renovate.json 2>/dev/null

# Check package ecosystem files
ls package.json go.mod requirements.txt Pipfile Gemfile pom.xml build.gradle \
   Cargo.toml composer.json *.csproj Dockerfile docker-compose.yml \
   *.tf .terraform.lock.hcl .github/workflows/*.yml .gitlab-ci.yml 2>/dev/null

# If using self-hosted Renovate
renovate --version
```

## Usage

Provide:

- **Repository path or URL** — the repo to configure Renovate for
- **Hosting platform** — GitHub, GitLab, Bitbucket, Azure DevOps
- **Team preferences** — automerge tolerance, PR frequency limits, review requirements
- **Custom registries** — Artifactory, Nexus, private npm/Docker registries

Example invocations:

> Generate a Renovate config for our monorepo. We use npm, Docker, Terraform, and GitHub Actions. We want automerge for patch updates, weekly batched PRs for minor, and manual review for major.

> Our Renovate is creating too many PRs. Analyze our dependencies and create grouping rules to reduce PR volume by 70%.

> Set up Renovate for our Python project with a private PyPI registry at pypi.internal.example.com.

## How It Works

### Step 1: Dependency Landscape Analysis

Scan the repository to identify all dependency ecosystems:

```bash
# Find all dependency files (npm, Go, Python, Ruby, Java, Rust, PHP, .NET, Docker, Terraform, CI, Helm)
find . -maxdepth 5 $ -name "package.json" -o -name "go.mod" -o -name "requirements*.txt" \
  -o -name "pyproject.toml" -o -name "Gemfile" -o -name "pom.xml" -o -name "Cargo.toml" \
  -o -name "Dockerfile" -o -name "*.tf" -o -name "Chart.yaml" \
$ -not -path "*/node_modules/*" -not -path "*/.git/*" 2>/dev/null

# Count dependencies per ecosystem
jq '.dependencies + .devDependencies | length' package.json 2>/dev/null
```

Build a dependency inventory per ecosystem: file count, dependency count, lockfile presence, private registry usage.

### Step 2: Grouping Strategy

Design grouping rules to reduce PR volume. The goal: related updates in a single PR, not 50 separate PRs per week.

Analyze package org/scope distribution and identify logical groups (lint tools, test frameworks, build tools, AWS SDK, type definitions). Generate grouping rules:

```json5
{
  "packageRules": [
    // Group 1: Lint and formatting tools
    {
      "groupName": "linting and formatting",
      "matchPackagePatterns": ["eslint", "prettier", "stylelint", "biome"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    },

// Group 2: Test frameworks
    {
      "groupName": "test frameworks",
      "matchPackagePatterns": ["jest", "vitest", "mocha", "chai", "testing-library", "playwright", "cypress"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    },

// Group 3: Build tools
    {
      "groupName": "build tools",
      "matchPackagePatterns": ["webpack", "vite", "rollup", "esbuild", "swc", "tsup", "turbo"],
      "matchUpdateTypes": ["minor", "patch"]
    },

// Group 4: AWS SDK (often has 20+ packages)
    {
      "groupName": "aws sdk",
      "matchPackagePatterns": ["^@aws-sdk/"],
      "automerge": true
    },

// Group 5: Type definitions
    {
      "groupName": "type definitions",
      "matchPackagePatterns": ["^@types/"],
      "automerge": true
    },

// Group 6: Same-org packages
    {
      "groupName": "{{packagePatterns}} packages",
      "matchPackagePatterns": ["^@your-org/"],
      "automerge": true
    },

// Group 7: Terraform providers
    {
      "groupName": "terraform providers",
      "matchManagers": ["terraform"],
      "matchDepTypes": ["provider"],
      "matchUpdateTypes": ["minor", "patch"]
    },

// Group 8: Docker base images (non-major)
    {
      "groupName": "docker base images",
      "matchManagers": ["dockerfile"],
      "matchUpdateTypes": ["minor", "patch", "digest"]
    },

// Group 9: GitHub Actions
    {
      "groupName": "github actions",
      "matchManagers": ["github-actions"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}
```

### Step 3: Automerge Policy

Define what can be automerged safely based on the project's CI pipeline quality and test coverage. Check for CI config files and test frameworks to assess automerge safety:

**Automerge tiers:**

```json5
{
  "packageRules": [
    // Tier 1: Safe to automerge (dev-only, well-tested ecosystem)
    {
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "branch",  // No PR created, merged directly
      "description": "Dev dependency patches — type defs, linters, test runners"
    },

// Tier 2: Automerge with PR (want visibility but no review needed)
    {
      "matchUpdateTypes": ["patch"],
      "matchDepTypes": ["dependencies"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true,  // Use GitHub/GitLab native automerge
      "description": "Production dependency patches — automerge after CI passes"
    },

// Tier 3: No automerge (needs human review)
    {
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "reviewers": ["team:platform"],
      "labels": ["breaking-change"],
      "prPriority": 10,
      "description": "Major version bumps — may contain breaking changes"
    }
  ]
}
```

### Step 4: Schedule Configuration

Set update schedules that respect team workflow:

```json5
{
  // When Renovate creates PRs
  "schedule": ["before 7am on Monday"],  // Weekly batch, ready for Monday morning

// Override for security updates (immediate)
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "matchCategories": ["security"],
      "schedule": ["at any time"],  // Security patches: no schedule delay
      "automerge": true,
      "prPriority": 20
    }
  ],

// Limit concurrent PRs to avoid overwhelming CI
  "prConcurrentLimit": 10,
  "prHourlyLimit": 3,

// Branch concurrent limit
  "branchConcurrentLimit": 15
}
```

### Step 5: Custom Managers

For dependencies Renovate doesn't detect automatically, create custom managers:

```json5
{
  "customManagers": [
    // Dockerfile ARG versions
    {
      "customType": "regex",
      "fileMatch": ["(^|/)Dockerfile$"],
      "matchStrings": [
        "ARG \\w+_VERSION=(?<currentValue>\\S+)\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)"
      ],
      "description": "Update version ARGs in Dockerfiles"
    },

// .tool-versions (asdf)
    {
      "customType": "regex",
      "fileMatch": ["(^|/)\\.tool-versions$"],
      "matchStrings": [
        "(?<depName>\\S+)\\s+(?<currentValue>\\S+)"
      ],
      "datasourceTemplate": "github-tags",
      "description": "Update .tool-versions entries"
    },

// Kubernetes manifests (image tags)
    {
      "customType": "regex",
      "fileMatch": ["(^|/)k8s/.+\\.ya?ml$"],
      "matchStrings": [
        "image:\\s*(?<depName>[^:]+):(?<currentValue>[^\\s\"]+)"
      ],
      "datasourceTemplate": "docker",
      "description": "Update image tags in Kubernetes manifests"
    },

// GitHub Actions pinned SHAs
    {
      "customType": "regex",
      "fileMatch": ["^\\.github/workflows/.+\\.ya?ml$"],
      "matchStrings": [
        "uses:\\s*(?<depName>[\\w-]+/[\\w-]+)@(?<currentDigest>[a-f0-9]{40})\\s*#\\s*v(?<currentValue>\\S+)"
      ],
      "datasourceTemplate": "github-tags",
      "description": "Update pinned GitHub Action SHAs"
    }
  ]
}
```

### Step 6: Private Registry Configuration

Generate `hostRules` entries for each private registry detected (npm, Docker/ECR, Terraform, Artifactory). Each rule includes `matchHost`, `hostType`, and token references using `{{ secrets.* }}` syntax so credentials aren't hardcoded. Also configures `registryAliases` when internal mirrors are used (e.g., `docker.io` -> `mirror.internal.example.com`).

### Step 7: Monorepo Configuration

For monorepos, configure per-workspace branch prefixes and commit message prefixes (e.g., `api: `, `web: `) so PRs are scoped to the right package. Group shared devDependencies across workspaces to avoid duplicate PRs. Set `ignorePaths` for `node_modules`, `vendor`, `dist`, and `build` directories.

### Step 8: Final Config Assembly

Assemble the complete `renovate.json5` combining all rules above, extending community presets (`config:recommended`, `helpers:pinGitHubActionDigests`, `:semanticCommits`, `group:monorepos`, `replacements:all`, `workarounds:all`), and adding vulnerability alert overrides (security label, security team reviewers, no schedule delay, automerge enabled).

## Output

The agent produces:

1. **Dependency landscape report** — ecosystem breakdown, count of dependencies per type, private registries detected
2. **Complete `renovate.json5`** — ready to commit, with comments explaining each rule
3. **Grouping analysis** — expected PR volume reduction (e.g., "from ~45 PRs/week to ~8")
4. **Automerge safety assessment** — which tiers are safe to automerge based on CI pipeline quality
5. **Custom manager definitions** — for any dependency sources Renovate doesn't detect natively
6. **Migration notes** — if migrating from Dependabot or another tool, mapping of existing config
7. **Onboarding PR preview** — what the initial Renovate onboarding PR will look like

## PR Volume Reduction Strategies

- **Group by org/scope** — 40-60% reduction, trade-off: larger PRs harder to bisect
- **Group dev dependencies** — 20-30% reduction, trade-off: may miss tooling breakage
- **Automerge patches** — 30-50% reduction, requires good CI coverage
- **Weekly schedule** — 70-80% reduction, updates delayed up to 7 days
- **Digest pinning** — 10-15% more PRs but better reproducibility

_meta.json Metadata

{
  "ownerId": "kn7d5eszdfwftk153ymhdm4qhs83qsqy",
  "publishedAt": 1777635991131,
  "slug": "renovate-config-generator",
  "version": "1.0.0"
}