feat!: consolidate the general-purpose presets into default.json

[onedr0p]

Problem

A #tag on a preset reference does not propagate to references made inside that preset, and Renovate has no relative or self-referencing preset syntax: parsePreset (config/presets/parse.js:70-88) resolves every reference to an absolute source, repo, path and tag. default.json listed its siblings untagged, so Renovate resolved every one of them from the default branch regardless of what tag a consumer pinned. Two consequences:

1. The pin was inert. Anyone on #5.0.0 was running main's preset bodies, and had been all along.
2. The directory layout was a permanent public API. feat!: make app-specific presets opt-in under apps/ #86 moved the app-specific presets under apps/, breaking every previously published tag at once: default.json@5.0.0 still asks main for managers/cnpg.json5. Downstream saw Cannot find preset's package (...). Note: this is a *nested* preset and Renovate stopped opening PRs entirely (example: Action Required: Fix Renovate Configuration onedr0p/home-ops#11489).

Change

config/, managers/, overrides/ and policies/ are folded into default.json. It is one self-contained preset now, so a tag pins all of it and the layout stops being something no published tag can stop depending on.

apps/ is untouched. Separating the defaults from opt-in application presets is the point of the repo; only the defaults needed consolidating, and they were always consumed as a set.

This also drops the general-purpose presets from thirteen fetches to one. The only references left are stock Renovate presets, which resolve from inside the binary rather than over the network:

OLD default.json extends            NEW default.json extends
  NETWORK  //config/baseConfig.json5      in binary  config:recommended
  NETWORK  //config/dependencyDashboard   in binary  docker:enableMajor
  ... 10 more ...                         in binary  helpers:pinGitHubActionDigestsToSemver
  network fetches: 12                     ... 3 more ...
                                          network fetches: 0

scripts/, the gen and verify mise tasks, and the CI steps that regenerated and cross-checked default.json are all removed. There is no generated file left to drift or to diff against its sources.

Rationale that lived in JSON5 comments moves into the description of the rule it explains, which is the only prose strict JSON carries and which surfaces in resolved config. Nothing was dropped.

Verification

Both refs run through Renovate's own resolveConfigPresets and diffed. The entire difference is the three description edits above:

36c36
<   "Process annotated dependencies"
>   "Process annotated dependencies: a `# renovate: datasource=<ds> depName=<name>` comment followed by ..."
10545c10545
<   "zer0ver: 0.x minors can break at any time, give them the breaking `!` prefix"
>   "... No matchCurrentVersion guard is shipped for automerge: repo packageRules concatenate ..."
10556c10556
<   "zer0ver: 0.x minors can break at any time, route them onto the major branches"
>   "... The default branchName template includes additionalBranchPrefix, so this lands them ..."

Ignoring description fields the two resolved configs are equal, and the counts match: 733 packageRules, 4 customManagers, 1 registryAliases, same dependencyDashboardTitle.

mise run lint, mise run validate over all 8 remaining configs, actionlint and zizmor are clean.

Breaking

The general-purpose presets no longer exist as individual files. Extending //policies/zer0ver.json5, or any other path under config/, managers/, overrides/ or policies/, stops resolving. Extend the repo itself instead. ignorePresets can no longer drop one of them out of the bundle, which shouldResolvePreset did allow while they were separate references. apps/ presets are unaffected and stay individually opt-in.

Tags at or below 6.0.0 are not repaired; their default.json will ask main for managers/cnpg.json5 forever. Fixing that would mean restoring the moved paths as shims. Deliberately skipped: the broken-config issue Renovate files is loud enough to drive an upgrade.

[onedr0p]

Added a guard, after considering whether release-please should stamp the version onto the nested refs instead.

Why not stamping. It would work, and it would be more general than inlining, but release-please cannot do it natively. The json updater replaces the whole value at a jsonpath, so $.extends[*] would rewrite each entry to the literal "6.0.0". The generic updater is line-based and needs an x-release-please-version annotation comment, which strict JSON cannot carry, and Renovate only ever fetches default.json for a bare repo reference (config/presets/util.js:20-24, falling back only to a deprecated renovate.json), so the file cannot move to a commentable format. That leaves a custom regeneration step on the bot's release branch, which ci.yaml:28-30 deliberately skips. It would also mean main's default.json points at the last release's leaves, so unpinned consumers stop tracking main between releases, and it costs 13 preset fetches per repo per run instead of 1.

What stamping was right about. Inlining only works because the nesting is one level deep, and nothing enforced that. A sibling extends in any leaf preset passed straight through into the generated extends list untagged, putting the bug back with nothing looking wrong.

mise run gen now fails on any preset that extends a sibling:

$ node scripts/gen-default.mjs
Error: overrides/mise.json5 extends github>home-operations/renovate-presets//config/registryAliases.json5
Presets must be self-contained: a tag does not propagate into a preset's own references.

The check covers apps/ too, even though those stay out of the bundle: an opt-in preset is exactly what a consumer pins a tag on directly, so the same reference would reach them unpinned.

default.json is byte-identical to the commit verified above (blob c787ae0), and the resolved-config diff against main was re-run on the updated branch: still identical, 10569 lines. Lint clean.

[onedr0p]

Switched from inlining to stamping. Superseded approach is in the force-pushed history; the PR description now reflects what is here.

Correcting myself twice on the way: extra-files type json maps to GenericJson, which substring-replaces the version inside each string rather than replacing the whole value, so stamping was always natively expressible. And the variant I then proposed, untagged on main with stamping only at release, cannot bootstrap, since GenericJson skips any string with no version to replace.

[onedr0p]

Back to inlining, now with mise run verify closing the gap that made stamping attractive.

Checked Renovate's parser rather than the docs: parsePreset resolves every reference to an absolute source, repo, path and tag, with no relative or self-referencing form, and path syntax and sub-preset syntax cannot be combined at all. There is no supported mechanism for tag inheritance, so a self-contained default.json is the shape the model actually supports and stamping was tooling compensating for a shape Renovate has no story for.

Also withdrawing something I said earlier in this thread: renovatebot/renovate#15464 is about multiple presets inside one file, not about presets extending presets, so it was not evidence either way.