Prettier's output depends on its version. When prettier-plugin-tailwindcss
went from 0.8.0 to 0.8.1 it started sorting class names differently, and all
27 Svelte files in hamer/website silently drifted out of format. The bump
arrived through lockFileMaintenance, which only touches the lock file, so
package.json never showed it.
rangeStrategy: pin writes the exact version into package.json. Lock file
maintenance can no longer move it unseen, and every bump is visible in the
diff.
The reformatting itself is already handled by the npm-wide postUpgradeTasks
rule, so this only adds the pinning and the grouping. The group is not
automerged: when the bot lacks the command allowlist the reformatting is
skipped silently, and an unattended merge would bring the drift straight
back.
The README documents both rules and the RENOVATE_ALLOWED_COMMANDS value the
self-hosted bot needs, which was not written down anywhere yet.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ghd74zZHdKuvt9pv7Z7Hk
Signed-off-by: Peter Siegmund <peter.siegmund@entwicklung.eq-3.de>
Security PRs raised via vulnerabilityAlerts had no automerge, so they
sat open until merged by hand — e.g. blog-svelte #35 (sharp) stayed open
even though CI was green. These are exactly the updates that should land
fastest, and platformAutomerge still gates them on the required checks.
Add automerge to the vulnerabilityAlerts block. It overrides the per-repo
group rules (e.g. the ungrouped 'svelte + build toolchain'), because
Renovate splits vulnerability updates into their own branches anyway.
Signed-off-by: Peter Siegmund <peter.siegmund@entwicklung.eq-3.de>
A prettier version bump changes prettier's canonical output, so files
that were correctly formatted under the old version now fail
`prettier --check` in CI — the update PR goes red and never automerges.
This happened on castaway with prettier 3.8.3 -> 3.9.6 (two files
reformatted: a union type collapsed to one line, a Svelte closing tag
pulled onto the attribute line).
Add a npm-scoped postUpgradeTasks that runs `npm run format` once per
branch after the upgrade and commits the result. `--if-present` makes it
a no-op in npm repos without a format script; matchManagers npm keeps it
away from the gradle/maven and firmware repos that share this preset.
Requires the self-hosted Renovate instance to whitelist the command via
allowedCommands (e.g. RENOVATE_ALLOWED_COMMANDS='^npm run format') — that
is a global/self-hosted-only option and cannot be set from this preset.
Signed-off-by: Peter Siegmund <peter.siegmund@entwicklung.eq-3.de>
Peter SiegmundandClaude Opus 5
