Update renovate configs from maintainer and user feedback

[jonbartels]

Fixes to address comments from users and maintainers on Renvoate bot.

renovatebot/renovate#35165 I think this is key. We reference reccomended presets but I think some of those generate behaviors that are undesirable to OIE.

This PR was done by human hands and eyes, no clankers. I read https://docs.renovatebot.com/configuration-options/ and took the comments from maintainers and users in Discord.

Grouping is working but renovate submits security patches separately.

The all-minor-and-patch rule needs to go. Theres like 50 packages in there. Thats not what we want. It bundles all those minor updates into one massive set. Pauls clanker called this out as non-blocking in PR #358 but I think it is a problem. Thats one big-big PR.

If you're tweaking, I think the 2-day cooldown is too short, and something like 7-14 would be more appropriate for non-security patches. We don't move that quickly, and with it only checking once a month, anyway, we don't need it bringing in patches that fresh.

I can do days, but I do not think I can distinguish between security updates and other updates. This PR sets it to 14 days. I think security always gets pushed. See next topic.

I know when I was looking, there is also a way to limit the number of PRs it has opened at one time, so that we don't get overwhelmed with them.

We have this. Its set to 10, but per Renvoate docs:

Renovate always creates security PRs, even if the concurrent PR limit is already reached. Security PRs have [SECURITY] in their PR title.

The batch from PR #358 was entirely security updates. Renovate has many held updates that are non-security. These are visible at https://developer.mend.io/

Screenshot shows the ugly all-minor-and-patch behavior. It also shows groups working for non-security updates.

[github-actions]

Test Results

655 tests  ±0   655 ✅ ±0   2m 19s ⏱️ + 1m 0s
109 suites ±0     0 💤 ±0 
109 files   ±0     0 ❌ ±0 

Results for commit c9d2388. ± Comparison against base commit f421b3c.

♻️ This comment has been updated with latest results.

[tonygermano]

The PR comments claim that minimumReleaseAge on line 10 was adjusted to 14 days, but it is still at 2 days.

According to the docs, the schedule on line 7 is using a deprecated syntax. It suggests using cron syntax or one of the presets.

[jonbartels]

The PR comments claim that minimumReleaseAge on line 10 was adjusted to 14 days, but it is still at 2 days.

According to the docs, the schedule on line 7 is using a deprecated syntax. It suggests using cron syntax or one of the presets.

Fixed.

The minimumReleaseAge was updated locally but not pushed.

The schedule was updated to use a preset. I wasn't sure if renovate wants monthly or a fully qualified schedule:monthly for the preset value though.

[mgaffigan]

While we're here, you might also set "rebaseWhen": "conflicted" to avoid some of these PR updates every time main changes.