DO NOT MERGE: dependencyDashboard, matchPackageNames, hostRules placeholder for @wave-av registry

[yakimoto]

DO NOT MERGE — one human step still required (see bottom)

Measured evidence

Renovate's own Dependency Dashboard on wave-av/wave-foundation (issue #698) prints, verbatim:

Failed to look up npm package @wave-av/messaging: no-result
Failed to look up npm package @wave-av/observability: no-result

Root cause: wave-av/.github/renovate.json sets
"npmrc": "@wave-av:registry=https://npm.pkg.github.com" but supplies no credential for
that registry, so every npm-registry lookup for a @wave-av/* scoped package returns
no-result (GitHub Packages requires auth even for reads). Result: Renovate has never
opened a @wave-av/spoke-chassis bump PR in any of the ~61 consumer repos.

What changed in this PR

1. dependencyDashboard: true set explicitly (top-level), in addition to the existing
   :dependencyDashboard preset already in extends. This is the highest-value change
   landable without a token: every consumer repo that actually resolves this shared config
   will get a Dependency Dashboard issue printing its own Renovate failures, the same way
   wave-foundation's issue #698 already does — instead of failing with zero visible symptom.

2. matchPackagePatterns → matchPackageNames. matchPackagePatterns no longer appears
   anywhere in current Renovate docs (verified: zero hits against the live
   configuration-options page) — it is fully retired, not merely soft-deprecated. Migrated
   "matchPackagePatterns": ["^@wave-av/"] to the documented glob form
   "matchPackageNames": ["@wave-av/**"], per
   https://docs.renovatebot.com/configuration-options/#packagerulesmatchpackagenames (the
   docs' own example for scope-prefix matching is literally "@angular/**").

3. hostRules added — but NOT the way the brief assumed. I initially planned to use the
   classic app.renovatebot.com/encrypt → "encrypted": {"token": "..."} shape shown in
   Renovate's self-hosted "private packages" doc. Checking Mend's own Mend-hosted Apps
   Configuration → Credentials page first:

   "The Mend Renovate cloud apps no longer read encrypted secrets from Renovate config
   files in your repositories. You must migrate any secrets you currently keep in a
   Renovate config file, and upload them as secrets to org or repo settings pages on
   developer.mend.io."
   (https://docs.renovatebot.com/mend-hosted/credentials/)

   Since wave-av uses the Mend GitHub App (confirmed, not self-hosted), an encrypted blob
   pasted into this file would be silently ignored — it would look fixed and would not
   be. The current, actually-functional mechanism is a secrets-template reference resolved
   by the Mend Portal at runtime:

   "hostRules": [
     { "hostType": "npm", "matchHost": "https://npm.pkg.github.com/",
       "token": "{{ secrets.WAVE_AV_NPM_PKG_GITHUB_TOKEN }}" }
   ]

   This value needs no further edit once the matching secret exists (see human step below).

4. npmrc registry URL aligned with matchHost (added trailing slash) to match
   Renovate's own GitHub-Packages example exactly (mismatched slash has caused silent
   non-matches for other users per Renovate's issue tracker patterns for this exact config).

Why the caret-on-0.x behavior hid this for so long

@wave-av/* packages are consumed with npm's default caret range (^0.x.y). Renovate's
default rangeStrategy is auto, which for npm behaves as: if the newest version already
satisfies the existing range, do nothing (https://docs.renovatebot.com/configuration-options/#rangestrategy
— "if your package.json specifies ^1.0.0 and latest is 1.2.0, Renovate won't change
anything because 1.2.0 satisfies the range"). Caret on a 0.x version is even narrower —
it only floats the patch digit. The packageRule in this same file already sets
rangeStrategy: "bump" specifically to force visible PRs on every publish and defeat this
quieting effect — but that packageRule, like the npmrc credential, never reached any
consumer repo (see propagation finding below), so consumers got the least-visible possible
behavior: a caret range that silently absorbs same-0.x releases, on top of a registry
lookup that silently fails outright. Zero PRs looked exactly like "this scope just doesn't
publish often," not like "this is broken."

Why the dashboard fix matters independently of the credential

Even after a human adds the token, Renovate will still hit no-result failures for other
reasons over time (registry incidents, revoked/rotated tokens, new private scopes added
without updating npmrc/hostRules, rate limits). Without a Dependency Dashboard, every
future failure of this kind is invisible again, org-wide, indefinitely — exactly what
happened here for however long this config has existed. The dashboard is the fleet's only
early-warning surface for this entire class of failure; it needs to be on regardless of
whether today's specific credential problem is fixed.

Validator output

Ran renovate-config-validator --strict --no-global renovate.json via npx --package renovate
against both the currently-installed major (42.99.0) and the latest resolvable published
version (44.65.1 — 44.65.2/latest dist-tag currently 404s from the npm registry, a
registry-side issue unrelated to this PR):

INFO: Validating renovate.json as repo config
INFO: Config validated successfully against 1 file(s)

(A harmless RE2 not usable, falling back to RegExp warning appears on 44.65.1 — a
native-module build artifact of the sandboxed npx install, not a config issue.)

Other repos with their own renovate.json (checked per brief's instruction)

gh api search/code -f q='filename:renovate.json org:wave-av' returns exactly 3 hits in the
whole org: wave-av/.github (this file), wave-av/wave-foundation, and
wave-av/wave-foundation-public. Neither wave-foundation repo's renovate.json extends or
references wave-av/.github in any way — both are fully self-contained, with their own
":dependencyDashboard" and no npmrc/hostRules at all. That is consistent with
wave-foundation's issue #698 dashboard existing (it has its own explicit
dependencyDashboard config) independent of anything in this PR, and its no-result
errors coming from wave-foundation's own package.json depending on @wave-av/messaging/
@wave-av/observability directly, hitting the default (unauthenticated) npm registry
resolution path.

IMPORTANT — additional finding beyond the brief's scope (not fixed here, flagging honestly)

Cross-checking Mend's hosted-app docs (not just the generic self-hosted Renovate docs)
surfaced that wave-av/.github/renovate.json is very likely not read by the Mend GitHub
App for org-wide default/inherited config at all, independent of anything in this diff:

• Mend's "Mend-hosted Apps Configuration → Inherited config" page states the app looks for
  inherited config only in a repo literally named renovate-config (not .github),
  containing a file literally named org-inherited-config.json (not renovate.json):
  https://docs.renovatebot.com/mend-hosted/hosted-apps-config/
• wave-av/renovate-config does not exist (gh repo view wave-av/renovate-config → 404,
  verified this session).
• Since none of the ~61 consumer repos have their own renovate.json (confirmed by the
  same code search above), there is no "extends": ["github>wave-av/.github"]-style
  reference anywhere that would pull this file in another way either.
• Separately, Mend's docs note that orgs installed with "All repositories" default every
  repo to Silent mode (dryRun=lookup), which suppresses both PRs and Issues
  (including the Dependency Dashboard) regardless of config content, until flipped to
  Interactive at the repo or org level in the Mend Developer Portal.

I did not act on either of these — creating an org-visible renovate-config repository or
changing the GitHub App's install/silent-mode settings has organization-wide blast radius
and is exactly the kind of decision that needs a human, same as the credential. Flagging so
the credential fix in this PR isn't mistaken for "done" if the dashboards still don't show
up after it merges.

Exact remaining human step(s)

1. Credential (this PR's placeholder): an org admin signs in to
   https://developer.mend.io, opens the wave-av organization's Credentials settings
   page, and adds an org-level secret named exactly WAVE_AV_NPM_PKG_GITHUB_TOKEN
   containing a GitHub PAT scoped to read:packages for the wave-av org (classic PAT, or
   a fine-grained PAT with Packages: Read). No further file edit is needed — the
   {{ secrets.WAVE_AV_NPM_PKG_GITHUB_TOKEN }} reference in this file resolves
   automatically once that secret exists. (This replaces the brief's assumed
   app.renovatebot.com/encrypt step, which Mend's cloud app no longer honors — see above.)
2. Propagation (new finding, separate decision): confirm with a wave-av org admin
   whether wave-av/.github/renovate.json is intended to be the org-wide default, and if
   so, create wave-av/renovate-config with org-inherited-config.json (same content as
   this file) per Mend's actual inherited-config mechanism, and confirm the app's install
   mode (All vs. Selected repositories / Silent vs. Interactive) in the Mend Developer
   Portal — otherwise steps 1–4 in this PR may have no observable effect on the 61 consumer
   repos.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BdUbkR1zhogcTMWdbFRJKz

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by Sourcery

Improve Renovate visibility and private @wave-av package resolution by enabling dashboards and updating registry authentication and package matching configuration.

New Features:

• Enable Renovate Dependency Dashboards to expose dependency lookup failures and update status.

Bug Fixes:

• Configure authenticated access to the private @wave-av npm registry through a Mend-hosted secret reference.
• Update scoped package matching to the supported matchPackageNames configuration and align registry host matching.

Tests:

• Validate the Renovate configuration successfully with strict validation against Renovate 42.99.0 and 44.65.1.

Chores:

• Document the remaining Mend credential and org-wide configuration propagation steps required for the changes to take effect.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the shared Renovate configuration to expose lookup failures, use current package matching syntax, and reference a Mend-hosted GitHub Packages token. The configuration validates, but the PR is intentionally incomplete operationally: an org-level secret and confirmation or remediation of Mend inherited-config and installation-mode settings are still required before the changes can affect the intended consumer repositories.

File-Level Changes

Change	Details	Files
Makes Renovate failures visible and updates the private GitHub Packages configuration for scoped wave-av dependencies.	Explicitly enables the Dependency Dashboard. Replaces the retired package-pattern option with glob-based package-name matching. Adds a Mend-hosted secrets-template token rule for npm.pkg.github.com. Aligns the npm registry URL with the host rule using a trailing slash. Retains the existing bump strategy intended to force updates for published 0.x packages.	renovate.json
Documents deployment prerequisites and limitations that may prevent the configuration from affecting consumer repositories.	Identifies the required Mend organization secret and GitHub Packages read permission. Flags that the .github/renovate.json location may not be recognized as Mend inherited configuration. Calls out the need to verify the renovate-config repository convention and Mend Interactive versus Silent mode. Records validation against Renovate 42.99.0 and 44.65.1.	renovate.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.