Add low-risk tier shared Renovate preset

[bryanbeverly]

Summary

Adds renovate-config-low-risk.json — a shared preset for low-risk repos that extends the base preset and adds automerge rules for minor/patch updates across Go, JS, Docker, Python, and all GitHub Actions updates.

This allows low-risk repo configs to be a one-liner:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["github>trufflesecurity/.github:renovate-config-low-risk"]
}

Instead of repeating 5 packageRules entries in every repo.

Why

Feedback on the initial low-risk config PRs (e.g. oink#5) noted that the cookie-cutter template includes automerge rules for ecosystems that don't exist in the repo, which is misleading to reviewers. Moving the rules into a shared preset keeps per-repo configs minimal and accurate while maintaining consistent automerge policy across all low-risk repos.

Non-matching rules are functionally harmless — Renovate simply skips them. But centralizing them here means repo maintainers see a preset name, not a wall of ecosystem-specific rules to evaluate.

Context

Part of the Dependency Strategy Unification plan (PLAT-227).

Test plan

• renovate-config-validator passes
• After merge, update the 8 low-risk repo PRs to use the one-liner config
• Verify Renovate resolves the preset correctly on next run

Made with Cursor

---

Note

Low Risk
Config-only change to Renovate automerge policy; no application runtime or security-sensitive code paths are modified.

Overview
Adds renovate-config-low-risk.json, a shared Renovate preset that extends the org base config (github>trufflesecurity/.github:renovate-config) and centralizes automerge policy for low-risk dependency updates.

Repos can adopt a one-liner extends on github>trufflesecurity/.github:renovate-config-low-risk instead of copying five packageRules blocks. The preset enables automerge for minor/patch/pin/digest on Go, JS, Docker, and Python, and automerges all GitHub Actions updates.

^{Reviewed by Cursor Bugbot for commit a3cec35. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sysread]

Remember that we probably also need to add an org-level bypass for renovate to be able to merge prs without requiring codeowners approvals.

[bryanbeverly]

Remember that we probably also need to add an org-level bypass for renovate to be able to merge prs without requiring codeowners approvals.

That's one of the last steps. I'm doing it in this order so that we can watch it through a Monday cycle without it automerging, investigate the PRs it created, and then make the call on adding the bypass.