From 8a0a09eb50b8bc626e4e9400fc8abe6ec90e23bf Mon Sep 17 00:00:00 2001
From: Patrice Chalin <pchalin@gmail.com>
Date: Mon, 31 Aug 2026 09:54:19 -0400
Subject: [PATCH 1/2] Renovate: group patch and minor updates

- Mirrors docsy's update-grouping rules (docsy#2776); majors stay individual
---
 CONTRIBUTING.md | 12 +++++++-----
 renovate.json5  |  8 ++++++++
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 10cf69b49f..d4f1ad3ade 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -41,11 +41,13 @@ Renovate opens version-update PRs, created on Sundays, configured in
   committed lockfile; transitive security fixes arrive alert-driven instead.
 - `gomod` off: the Docsy theme pin is updated manually; see
   [Upgrade Docsy](#upgrade-docsy). All other detected managers are active.
-- Package rules: `hugo-extended` is version-pinned and coupled to its
-  `allowScripts` approval (see [Update Hugo](#update-hugo)); bootstrap and Font
-  Awesome updates route through the theme (`packages/hugoautogen` is regenerated
-  from the theme, reverting any direct bump). A Dependabot security PR may still
-  bump these directly: close it and route the fix through a theme update.
+- Package rules: patch and minor updates are each grouped into a single PR per
+  wave (majors stay individual); `hugo-extended` is version-pinned and coupled
+  to its `allowScripts` approval (see [Update Hugo](#update-hugo)); bootstrap
+  and Font Awesome updates route through the theme (`packages/hugoautogen` is
+  regenerated from the theme, reverting any direct bump). A Dependabot security
+  PR may still bump these directly: close it and route the fix through a theme
+  update.
 
 Renovate's vulnerability-alert PRs stay on (immediate, cooldown-exempt), beside
 GitHub's Dependabot security updates; a rare duplicate PR is accepted.
diff --git a/renovate.json5 b/renovate.json5
index 95f6dd202f..d5afef709c 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -11,6 +11,14 @@
   gomod: { enabled: false },
   minimumReleaseAge: '7 days',
   packageRules: [
+    {
+      groupName: 'all patch versions',
+      matchUpdateTypes: ['patch'],
+    },
+    {
+      groupName: 'all minor versions',
+      matchUpdateTypes: ['minor'],
+    },
     {
       matchPackageNames: ['hugo-extended'],
       enabled: false, // Manually updated to match Docsy requirements

From 38a87e1fa090b21adf3721b7f120497a19d79467 Mon Sep 17 00:00:00 2001
From: Patrice Chalin <pchalin@gmail.com>
Date: Mon, 31 Aug 2026 16:26:21 -0400
Subject: [PATCH 2/2] Narrow the majors claim; restructure the package-rules
 bullet

- Preset lockstep families (e.g. GitHub artifact actions) stay grouped even for majors; the flat claim was false (review finding)
- Splits the four packed policies into a nested list, matching docsy's docs-home shape
---
 CONTRIBUTING.md | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d4f1ad3ade..3b80343927 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -41,13 +41,16 @@ Renovate opens version-update PRs, created on Sundays, configured in
   committed lockfile; transitive security fixes arrive alert-driven instead.
 - `gomod` off: the Docsy theme pin is updated manually; see
   [Upgrade Docsy](#upgrade-docsy). All other detected managers are active.
-- Package rules: patch and minor updates are each grouped into a single PR per
-  wave (majors stay individual); `hugo-extended` is version-pinned and coupled
-  to its `allowScripts` approval (see [Update Hugo](#update-hugo)); bootstrap
-  and Font Awesome updates route through the theme (`packages/hugoautogen` is
-  regenerated from the theme, reverting any direct bump). A Dependabot security
-  PR may still bump these directly: close it and route the fix through a theme
-  update.
+- Package rules:
+  - Patch and minor updates are each grouped into a single PR per wave, to cut
+    review overhead. Majors stay individual, except families that Renovate's
+    presets keep in lockstep (for example, the GitHub artifact actions).
+  - `hugo-extended` is version-pinned and coupled to its `allowScripts` approval
+    (see [Update Hugo](#update-hugo)).
+  - Bootstrap and Font Awesome updates route through the theme
+    (`packages/hugoautogen` is regenerated from the theme, reverting any direct
+    bump). A Dependabot security PR may still bump these directly: close it and
+    route the fix through a theme update.
 
 Renovate's vulnerability-alert PRs stay on (immediate, cooldown-exempt), beside
 GitHub's Dependabot security updates; a rare duplicate PR is accepted.