chore(renovate): low-noise config — group weekly, automerge non-major

pyproject.toml

@@ -19,31 +19,31 @@ requires-python = ">=3.12"
 # renovatebot/renovate#41624). `uv.lock` is the reproducible manifest generated
 # by uv (never hand-edited).
 dependencies = [
-    "astropy>=7.0",          # major 6 → 7
+    "astropy==7.2.0",          # major 6 → 7
     "astroquery",
     "canfar",
     "cs_util>=0.2.1",
-    "galsim>=2.8",
+    "galsim==2.8.4",
     "h5py",
-    "joblib>=1.4",
-    "matplotlib>=3.10",
-    "mccd>=1.2.4",
-    "modopt>=1.6",
-    "mpi4py>=4.1.2",
-    "numba>=0.59",           # numpy 2 support
-    "numpy>=2.4.6",            # major 1 → 2
-    "pandas>=3.0.3",           # major 2 → 3
+    "joblib==1.5.3",
+    "matplotlib==3.10.9",
+    "mccd==1.2.4",
+    "modopt==1.7.2",
+    "mpi4py==4.1.2",
+    "numba==0.65.1",           # numpy 2 support
+    "numpy==2.4.6",            # major 1 → 2
+    "pandas==3.0.3",           # major 2 → 3
     "python-dateutil",
-    "python-pysap>=0.3",
+    "python-pysap==0.3.0",
     "PyQt5",
     "pyqtgraph",
-    "reproject>=0.19",
-    "sf_tools>=2.0.4",
-    "skaha>=1.7",
-    "sqlitedict>=2.0",
+    "reproject==0.19.0",
+    "sf_tools==2.0.4",
+    "skaha==1.7.0",
+    "sqlitedict==2.1.0",
     "termcolor",
-    "tqdm>=4.68.1",
-    "vos>=3.6",
+    "tqdm==4.68.1",
+    "vos==3.6.4",
     "ngmix>=2.4",
 ]
 
@@ -57,9 +57,9 @@ doc = [
     "sphinx-book-theme"
 ]
 jupyter = [
-    "ipython>=9.14.1",
-    "jupyterlab>=4.5.9",
-    "snakemake>=9.22.0",
+    "ipython==9.14.1",
+    "jupyterlab==4.5.9",
+    "snakemake==9.22.0",
 ]
 lint = [
     "ruff",
@@ -69,9 +69,9 @@ release = [
     "twine",
 ]
 test = [
-    "hypothesis>=6.155.2",
-    "pytest>=8.3",
-    "pytest-cov>=5.0",
+    "hypothesis==6.155.2",
+    "pytest==9.1.1",
+    "pytest-cov==7.1.0",
 ]
 fitsio = ["fitsio"]
 dev = ["shapepipe[doc,jupyter,lint,release,test,fitsio]"]
@@ -99,7 +99,7 @@ cs_util = { git = "https://github.com/CosmoStat/cs_util", branch = "develop" }
 # Declaring a build backend makes shapepipe an installed package (not a uv
 # "virtual" project), so `uv sync` / `pip install -e .` put it on the path
 # rather than only its dependencies.
-requires = ["setuptools>=61"]
+requires = ["setuptools==82.0.1"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools]

renovate.json

@@ -1,16 +1,18 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "description": [
-    "Repo overrides on the Mend org/inherited config. Goal: keep the supply-chain minimum-release-age delay AND make dependency automerge reliable.",
-    "The org config sets rangeStrategy=update-lockfile via a packageRule, which outranks a top-level repo rangeStrategy (packageRules always beat top-level keys). So we set rangeStrategy=pin in a packageRule too — repo packageRules are merged LAST, so this wins. Pinning is the only way Renovate honors minimumReleaseAge with uv: floor ranges let uv resolve to a too-fresh version it can't pin (renovatebot/renovate#41624). shapepipe ships as a container, not a PyPI library, so pinning is appropriate. Scoped to PyPI datasource, so the git-sourced ngmix/cs_util are left untouched.",
-    "internalChecksFilter=strict: only act on versions past the age gate. minimumReleaseAge=3 days: supply-chain detection window; tunable."
+    "Low-noise dependency updates with mild supply-chain hygiene, layered on the Mend org config.",
+    "Pins: ShapePipe ships as a container, not a PyPI library, so per the Renovate dependency-pinning doc we pin app dependencies exactly. The pins are written directly in pyproject.toml (== versions), so nothing depends on rangeStrategy resolution against the org config; the packageRule (scoped to PyPI, leaving git-sourced deps like ngmix/cs_util alone) just keeps future deps pinned. Exact pins are also what lets minimumReleaseAge work with uv (renovatebot/renovate#41624).",
+    "Python base-image bumps (3.12 -> 3.14 rides as 'minor' in Renovate's python versioning) never automerge — a Python upgrade gets human eyes.",
+    "Noise: all non-major updates grouped into one weekly PR that automerges when CI (full suite in the container) is green; majors surface individually for review; lockFileMaintenance refreshes transitive deps.",
+    "minimumReleaseAge=7 days: supply-chain detection window, sized per the Renovate docs' automerge guidance and Astral's uv guide."
   ],
-  "internalChecksFilter": "strict",
-  "minimumReleaseAge": "3 days",
+  "extends": ["config:recommended", "group:allNonMajor", "schedule:weekly"],
+  "minimumReleaseAge": "7 days",
+  "lockFileMaintenance": { "enabled": true },
   "packageRules": [
-    {
-      "matchDatasources": ["pypi"],
-      "rangeStrategy": "pin"
-    }
+    { "matchDatasources": ["pypi"], "rangeStrategy": "pin" },
+    { "matchUpdateTypes": ["minor", "patch", "pin", "digest"], "automerge": true },
+    { "matchPackageNames": ["python"], "automerge": false }
   ]
 }