From 46736a55b5f54ba732091452a193d78875a99369 Mon Sep 17 00:00:00 2001
From: bakerboy448 <55419169+bakerboy448@users.noreply.github.com>
Date: Thu, 22 Oct 2026 19:51:04 -0500
Subject: [PATCH] feat: add shared Renovate automerge preset and self-hosted CI

renovate-automerge.json automerges patch and minor bot PRs once CI passes,
after a 3-day release-age hold. Repos extend it with
github>baker-scripts/.github:renovate-automerge.

ci.yml runs pre-commit on pull requests and pushes to main so this repo has
a required status check.
---
 .github/actionlint.yaml  |  2 ++
 .github/workflows/ci.yml | 28 ++++++++++++++++++++++++++++
 renovate-automerge.json  | 17 +++++++++++++++++
 renovate.json            |  2 +-
 4 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 renovate-automerge.json

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..b1738cd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,2 @@
+self-hosted-runner:
+  labels: [hetzner]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..10fb586
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+---
+name: CI
+
+"on":
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    # Fork PRs never run on the self-hosted runner.
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, Linux, X64, hetzner]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        env:
+          SKIP: no-commit-to-branch
diff --git a/renovate-automerge.json b/renovate-automerge.json
new file mode 100644
index 0000000..b9efbd7
--- /dev/null
+++ b/renovate-automerge.json
@@ -0,0 +1,17 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Shared bot-PR automerge policy for bakerboy448/* and baker-scripts/*: patch and minor updates automerge once CI passes, after a 3-day release-age hold. Public repos use GitHub auto-merge gated on required status checks. Private repos on GitHub Free set platformAutomerge to false, so Renovate merges only when every status check on the branch is green and never when a branch has zero checks. Rules in a repo's own config come after this preset and win.",
+  "platformAutomerge": true,
+  "ignoreTests": false,
+  "packageRules": [
+    {
+      "description": "Patch and minor updates: automerge when CI is green, held 3 days so a bad release surfaces first",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "minimumReleaseAge": "3 days",
+      "automerge": true
+    }
+  ]
+}
diff --git a/renovate.json b/renovate.json
index 3dcd5b6..93ecaea 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,6 +3,7 @@
   "description": "Inlined house Renovate config — self-contained, public presets only.",
   "extends": [
     "config:best-practices",
+    "github>baker-scripts/.github:renovate-automerge",
     ":dependencyDashboard",
     ":semanticCommits",
     ":enableVulnerabilityAlertsWithLabel(security)"
@@ -21,7 +22,6 @@
   "separateMajorMinor": true,
   "separateMinorPatch": false,
   "automerge": false,
-  "platformAutomerge": false,
   "rebaseWhen": "conflicted",
   "branchPrefix": "renovate/",
   "ignoreDeps": [],