renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base", ":gitSignOff"],
  "schedule": ["before 4 am on the first day of the month"],
  "vulnerabilityAlerts": {
    "schedule": "before 4am"
  },
  "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
  "packageRules": [
    {
      "matchManagers": ["github-actions"],
      "excludePackageNames": ["slsa-framework/slsa-github-generator"],
      "groupName": "github-actions",
      "pinDigests": true
    },
    {
      "matchManagers": ["github-actions"],
      "matchPackageNames": ["slsa-framework/slsa-github-generator"],
      "groupName": "github-actions",
      "pinDigests": false
    },
    {
      "matchManagers": ["dockerfile"],
      "matchPackageNames": ["golang"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "golang"
    },
    {
      "matchManagers": ["gomod"],
      "matchPackageNames": ["go"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "golang"
    },
    {
      "matchManagers": ["gomod"],
      "excludePackageNames": ["go", "github.com/in-toto/in-toto-golang"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "go"
    },
    {
      "matchManagers": ["npm"],
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "npm"
    },
    {
      "matchManagers": ["npm"],
      "matchDepTypes": ["devDependencies"],
      "groupName": "npm dev"
    }
  ]
}