@homeflare/config 0.8.0 → 0.10.0

package/docs/repo-shape-inputs.md

@@ -0,0 +1,83 @@
+# Every input a repository declares, and what it renders
+
+`RepoShape` is the whole declaration. This is the field reference; the model —
+why a difference is an input or an exception and never a hand edit — is in
+[repo-shape.md](./repo-shape.md).
+
+## The fields
+
+| Field        | Renders                                                                                                      | Measured reason it is an input                                                                   |
+| ------------ | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
+| `owner`      | The `repo:` in `.changeset/config.json`                                                                      | The only text that varied in that file across 11 of 13 repositories                              |
+| `repository` | The same, plus the Dependabot target                                                                         | As above                                                                                         |
+| `runner`     | `runs-on:` in every job, whether `.github/actionlint.yaml` exists, and the header's billing note             | 12 repositories on the mini, 1 (`homeflare-kit`) on `ubuntu-latest`. One variable, three files   |
+| `publishes`  | `access: public\|restricted`, whether `privatePackages` is written, whether Dependabot watches `/packages/*` | `@changesets/cli` versions **nothing** when `privatePackages.version` is absent — a silent no-op |
+| `node`       | `actions/setup-node@v6` before `setup-bun`, in `check` and every bun extra job                               | See below                                                                                        |
+| `extraJobs`  | One job per entry, its stated reason above it, and its id in the `ci` aggregate's `needs`                    | 4 genuinely different jobs across 3 repositories                                                 |
+| `exceptions` | Nothing — it removes a file from the drift comparison                                                        | The escape hatch, priced so it is used last                                                      |
+
+## `node` — the input added 2026-09-22
+
+⛔ **The mini's job image carries no node at all.** `ubuntu-latest` always did, so a
+Bun-only prologue is right for twelve repositories and _silently wrong_ for two:
+
+- **homeflare-alerts** — `tests/alchemy-import.test.ts` spawns `node` to prove the modules
+  load the way the Alchemy CLI (`node …/cli.js`) loads them. Without a real node, three
+  tests fail with `Executable not found in $PATH: "node"`, measured on the runner.
+- **homeflare-blog** — Payload requires Node >= 24.15, so every lane needs it.
+
+Both had written the identical `actions/setup-node@v6` block by hand before this existed.
+The alternative was `except({ file: '.github/workflows/ci.yml', … })` in both — which
+would have handed the estate's two most complicated CI files back to hand-editing, in the
+round whose whole purpose was to stop that.
+
+```ts
+export const shape: RepoShape = {
+  owner: 'taslabs-net',
+  repository: 'homeflare-alerts',
+  runner: 'mini',
+  publishes: false,
+  node: 24, // a major, not a range: setup-node resolves the newest 24.x
+};
+```
+
+⚠️ `package-manager-cache: false` is rendered with it. Bun does the installing, so priming
+npm's cache costs time and caches nothing anything in the job reads.
+
+★ **`workflow lint` never gets it.** That job installs nothing — actionlint is preloaded
+on the image — so adding node there would pay for a toolchain no step uses.
+
+## `timeout` on an extra job
+
+`extraJob({ …, timeout: 15 })` renders `timeout-minutes: 15`.
+
+⚠️ **A hung job is not a failed job.** homeflare-blog's `runtime` job drives Playwright
+against a local workerd; a browser that never reaches its first paint holds a self-hosted
+slot for GitHub's default 360 minutes rather than reporting red, and on a 3-slot pool that
+is the whole pool. Only a job that starts something with its own wait — a browser, a
+server, a container — needs one. `check` does not: `bun run check` exits.
+
+## What the renderer owns, and what it does not
+
+The rendered `check` job runs one step: `bun run check`, the repository's own gate.
+
+That is deliberate. A workflow that re-lists `lint`, `types` and `test` is a second copy
+of the gate, and a copy can check _less_ than the original. Measured 2026-09-22:
+`bun run check` in `homeflare-kit` is `lint && types && build && test`, and its
+`tests/dist.test.ts` skips itself when `dist/` is absent — so a workflow that ran the
+three lanes without the build would drop that test silently and still report green.
+`homeflare-alerts` runs `check:types` and `build:web` in its check; `homeflare-subnet-calc`
+delegates to `verify`. All fourteen have a `check` script, and all fourteen are local-only.
+
+So the split is:
+
+| Owned by the renderer                            | Owned by the repository                    |
+| ------------------------------------------------ | ------------------------------------------ |
+| Triggers, permissions, concurrency, runner label | What `bun run check` runs                  |
+| Action versions and their pins                   | Which extra jobs exist, each with a reason |
+| The aggregate `ci` job and its `needs`           | Its `package.json` scripts                 |
+| The actionlint, Dependabot and changeset configs | —                                          |
+
+The cost, said plainly: a red X says `check` rather than naming the lane. `bun run check`
+short-circuits on the first failure and names the lane in its output, which is the same
+signal a person gets locally.

package/docs/repo-shape.md

@@ -150,28 +150,10 @@ Three further things the check refuses, each because it hides a reason:
 
 ## What the renderer owns, and what it does not
 
-The rendered `check` job runs one step: `bun run check`, the repository's own gate.
-
-That is deliberate. A workflow that re-lists `lint`, `types` and `test` is a second copy
-of the gate, and a copy can check _less_ than the original. Measured 2026-09-22:
-`bun run check` in `homeflare-kit` is `lint && types && build && test`, and its
-`tests/dist.test.ts` skips itself when `dist/` is absent — so a workflow that ran the
-three lanes without the build would drop that test silently and still report green.
-`homeflare-alerts` runs `check:types` and `build:web` in its check; `homeflare-subnet-calc`
-delegates to `verify`. All fourteen have a `check` script, and all fourteen are local-only.
-
-So the split is:
-
-| Owned by the renderer                            | Owned by the repository                    |
-| ------------------------------------------------ | ------------------------------------------ |
-| Triggers, permissions, concurrency, runner label | What `bun run check` runs                  |
-| Action versions and their pins                   | Which extra jobs exist, each with a reason |
-| The aggregate `ci` job and its `needs`           | Its `package.json` scripts                 |
-| The actionlint, Dependabot and changeset configs | —                                          |
-
-The cost, said plainly: a red X says `check` rather than naming the lane. `bun run check`
-short-circuits on the first failure and names the lane in its output, which is the same
-signal a person gets locally.
+The rendered `check` job runs one step: `bun run check`, the repository's own gate — so
+the renderer owns the plumbing and the repository owns what its gate runs. That split,
+and every field of `RepoShape` with the measurement behind it, is in
+[repo-shape-inputs.md](./repo-shape-inputs.md).
 
 ## Bumping `@homeflare/config` will go red before it goes green
 
@@ -179,7 +161,7 @@ signal a person gets locally.
 renderer changes — a new action version, a fixed permission — every repository that bumps
 `@homeflare/config` fails `bun run check` on the next run, because its committed files are
 now the _old_ render. That includes the Dependabot pull request that does the bumping,
-which cannot fix itself.
+which cannot fix itself ([repo-shape-dependabot.md](repo-shape-dependabot.md) says why).
 
 The fix is one command, and the failure names it. The rule that follows:
 

package/docs/versions.md

@@ -0,0 +1,50 @@
+# The estate version set: `@homeflare/config/versions`
+
+Status: published source. Not yet enforced anywhere outside the kit. Verified 2026-09-22.
+
+```ts
+import { ESTATE_VERSIONS } from '@homeflare/config/versions';
+
+ESTATE_VERSIONS.alchemy; // '2.0.0-beta.79'
+ESTATE_VERSIONS.bun; // '1.4.0', the same value as BUN_VERSION in ./repo-shape
+```
+
+| package                       | version             | why this one                                               |
+| ----------------------------- | ------------------- | ---------------------------------------------------------- |
+| `bun`                         | `1.4.0`             | the value every rendered CI installs (`BUN_VERSION`)       |
+| `alchemy`                     | `2.0.0-beta.79`     | the newest release on npm when this was written            |
+| `effect`                      | `4.0.0-rc.115`      | what that alchemy release overrides its whole workspace to |
+| `@distilled.cloud/cloudflare` | `1.0.0-rc.12`       | what that alchemy release depends on, exactly              |
+| `typescript`                  | `7.0.2`             | the kit catalog                                            |
+| `oxfmt` / `oxlint`            | `0.68.0` / `1.83.0` | the kit catalog; ahead of upstream's `^0.66.0` / `^1.82.0` |
+| `@types/bun`                  | `1.4.2`             | matches `bun`                                              |
+
+## Where the truth lives
+
+⛔ **The kit's root `catalog` is the source, and this export is its published copy.** Before
+this export existed, the pins were written in two places. Bun was `BUN_VERSION` in
+`./repo-shape`. Everything else sat in the kit's root `catalog`, which is never published.
+So no other repository had anything to compare its lockfile against.
+`tests/estate-versions.test.ts` in the kit fails whenever a value here differs from the
+catalog, from the root `overrides`, from `packageManager`, or from what the installed
+`alchemy` itself depends on. A bump therefore changes both in one PR, or it goes red.
+
+★ **Runtime pins follow `alchemy`.** `effect` and `@distilled.cloud/*` are whatever the
+pinned `alchemy` release was built and tested against. They move in the PR that bumps
+`alchemy`, never ahead of it. Upstream `main` already runs `effect` rc.117. That is not a
+reason to move until a release carries it.
+
+## What drifts today
+
+The kit's `alchemy-provider-standard` audit measured each estate repository's lockfile
+read-only on 2026-09-22:
+
+- Seven app repositories resolve `alchemy` 2.0.0-beta.78.
+- The monorepo resolves beta.77, with `effect` rc.112, distilled rc.9, oxfmt 0.66.0 and
+  oxlint 1.81.0, and installs with pnpm.
+- One app resolves TypeScript 5.9.3.
+- Every consumer resolves an older `@homeflare/config` than the one published.
+
+⚠️ **This export compares nothing on its own.** Adding a lockfile check to `checkProject`,
+so that every repository fails on drift, is a separate estate-wide rollout. It has to land
+together with the bumps it would demand. Otherwise every CI goes red on the same day.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/config",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Shared tsconfig, oxlint, oxfmt, and non-npm release helpers for HomeFlare projects.",
   "license": "MIT",
   "author": "Timothy Schneider",
@@ -53,6 +53,10 @@
       "types": "./dist/require-release-config.d.ts",
       "default": "./dist/require-release-config.js"
     },
+    "./versions": {
+      "types": "./dist/versions.d.ts",
+      "default": "./dist/versions.js"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {

package/src/repo-shape/automerge.ts

@@ -0,0 +1,144 @@
+/**
+ * `.github/workflows/dependabot-automerge.yml`, rendered.
+ *
+ * ★ THE OTHER HALF OF THE `homeflare` GROUP. Dependabot opens the bump; this arms GitHub's
+ *   own auto-merge on it; the branch ruleset's required checks (`ci`, `secret scan`)
+ *   decide whether it ever merges. Nothing here merges anything itself, and a merge
+ *   deploys nothing — every stack in the estate is deployed by hand.
+ *
+ * ⛔ `gh pr merge --auto` IS NOT ALWAYS "ARM". When the pull request is already CLEAN,
+ *   UNSTABLE or HAS_HOOKS it merges AT ONCE instead (cli/cli `pkg/cmd/pr/merge/merge.go`,
+ *   `isImmediatelyMergeable`, read at v2.101.0 — the version the mini's job image ships).
+ *   UNSTABLE is "mergeable, with a non-passing status", which is every pull request on a
+ *   branch whose rules require no check: before `check` has run, and even after it failed.
+ *   So the step reads the base branch's active rules first and refuses — a red check, never
+ *   a merge — when none requires a status check. Measured 2026-09-22: homeflare-builds (its
+ *   ruleset not deployed yet) and homeflare-desktop have none.
+ *
+ * ⛔ FIRST-PARTY ONLY: A `run:` STEP AND THE GitHub CLI, NO `uses:` AT ALL. GitHub's own
+ *   example ("Automating Dependabot with GitHub Actions") identifies the update with
+ *   `dependabot/fetch-metadata`, which the same page marks as "not certified by GitHub".
+ *   The group is identified by the branch Dependabot gives it instead, whose format is
+ *   dependabot-core's (`branch_namer/dependency_group_strategy.rb`, read at v0.397.0):
+ *   `<prefix>/<package manager>/<directory>/<group>-<10 hex MD5 digest>`, with the root
+ *   directory collapsing to nothing.
+ */
+import { HOMEFLARE_GROUP } from './dependabot.ts';
+import type { RepoShape } from './shape.ts';
+import { runsOn } from './shape.ts';
+import { renderSteps } from './yaml.ts';
+
+/**
+ * The branch prefix a job-level `if:` can test with `startsWith`. GitHub's expression
+ * language has no regex, so this is the cheap filter that keeps every other pull request
+ * from taking a runner slot; `GROUP_BRANCH` is the exact test inside the step.
+ */
+export const GROUP_BRANCH_PREFIX: string = `dependabot/bun/${HOMEFLARE_GROUP}-`;
+
+/**
+ * ⛔ EXACT, AND FAILS CLOSED. A solo update of `@homeflare/config` is
+ *   `dependabot/bun/homeflare/config-0.9.0` and a package named `homeflare-x` would be
+ *   `dependabot/bun/homeflare-x-1.2.3`; neither matches. If Dependabot ever changes its
+ *   format, the symptom is a bump that waits for a person — never one merged by mistake.
+ */
+export const GROUP_BRANCH: string = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;
+
+const HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.
+#
+# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.
+#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
+#
+# ★ HOW A KIT RELEASE ARRIVES: the \`${HOMEFLARE_GROUP}\` group in .github/dependabot.yml opens one
+#   pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.
+#   Nothing here merges anything itself, and merging deploys nothing.
+# ⛔ NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its
+#   docs mark "not certified by GitHub"; the group is recognised by its branch name instead.
+# ⛔ NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \`gh pr merge --auto\` would merge
+#   at once, unchecked. The job fails instead, so the pull request waits for a person.
+# ⚠️ A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config
+#   renders, the bump fails \`check\` (the drift test) and never goes green. Run
+#   \`bun run repo-shape:refresh\` on Dependabot's branch and push. ⛔ This workflow does not do
+#   it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit
+#   would never get the required checks and the pull request would wait forever.
+`;
+
+const TRIGGER = `name: dependabot auto-merge
+
+on:
+  pull_request:
+
+# ⛔ NOTHING AT THE TOP; the one job asks for exactly what \`gh pr merge --auto\` needs.
+permissions: {}
+
+concurrency:
+  group: automerge-\${{ github.ref }}
+  cancel-in-progress: true
+`;
+
+const JOB_NOTE = `  # ⛔ BOTH LOGINS, NOT EITHER. \`user.login\` is who opened the pull request; \`github.actor\` is
+  #   who started this run. A person pushing to Dependabot's branch changes the actor, so
+  #   their commit never arms anything; only Dependabot's own rebases do.`;
+
+const PERMISSIONS_NOTE = `    # ★ WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets
+    #   a read-only GITHUB_TOKEN unless the workflow raises it ("Troubleshooting Dependabot on
+    #   GitHub Actions" → "Changing GITHUB_TOKEN permissions").`;
+
+const ARM = `set -euo pipefail
+if [[ ! "$HEAD_REF" =~ ${GROUP_BRANCH} ]]; then
+  echo "::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed"
+  exit 0
+fi
+# ⛔ gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch
+#   rule that requires a status check keeps it BLOCKED until the checks have passed.
+required=$(gh api "repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF" \\
+  --jq '[.[] | select(.type == "required_status_checks")] | length')
+if [ "$required" = 0 ]; then
+  echo "::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed"
+  exit 1
+fi
+# ★ --squash: the house repositories allow squash merges only (declareRepoPolicy).
+gh pr merge --auto --squash "$PR_URL"`;
+
+/** The whole `dependabot-automerge.yml` for a shape. */
+export function renderAutomerge(shape: RepoShape): string {
+  // ⚠️ GitHub ACTIONS EXPRESSIONS, NOT TEMPLATE LITERALS: the runner interpolates `${{ … }}`
+  //   at job time, so they must reach the file verbatim (see security.ts for the same note).
+  // oxlint-disable-next-line no-template-curly-in-string
+  const headRef = '${{ github.head_ref }}';
+  // oxlint-disable-next-line no-template-curly-in-string
+  const baseRef = '${{ github.base_ref }}';
+  // oxlint-disable-next-line no-template-curly-in-string
+  const prUrl = '${{ github.event.pull_request.html_url }}';
+  // oxlint-disable-next-line no-template-curly-in-string
+  const token = '${{ secrets.GITHUB_TOKEN }}';
+  const condition = [
+    "github.event.pull_request.user.login == 'dependabot[bot]'",
+    "github.actor == 'dependabot[bot]'",
+    `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`,
+  ].join(' && ');
+
+  return `${HEADER}
+${TRIGGER}
+jobs:
+${JOB_NOTE}
+  arm:
+    name: arm auto-merge
+    if: ${condition}
+    runs-on: ${runsOn(shape.runner)}
+${PERMISSIONS_NOTE}
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+${renderSteps(
+  [
+    {
+      env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },
+      name: 'Arm auto-merge on the homeflare group',
+      run: ARM,
+    },
+  ],
+  3,
+)}
+`;
+}

package/src/repo-shape/ci.ts

@@ -10,8 +10,8 @@
  *   `needs`, so adding a job never means editing a branch ruleset. `repoShapeChecks()`
  *   returns exactly `['ci', 'secret scan']`, which is what `declareRepoPolicy` requires.
  */
-import type { ExtraJob, RepoShape } from './shape.ts';
-import { runsOn } from './shape.ts';
+import type { ExtraJob, JobStep, RepoShape } from './shape.ts';
+import { nodeMajor, runsOn } from './shape.ts';
 import { renderSteps } from './yaml.ts';
 
 /** Bun the whole estate is pinned to. One line, one place. */
@@ -21,6 +21,7 @@ export const ACTIONLINT_VERSION = '1.7.12';
 
 const CHECKOUT = 'actions/checkout@v7';
 const SETUP_BUN = 'oven-sh/setup-bun@v2';
+const SETUP_NODE = 'actions/setup-node@v6';
 
 function runnerNote(shape: RepoShape): string {
   if (shape.runner !== 'mini') {
@@ -148,31 +149,49 @@ const VERIFY = `if [ "\${{ contains(needs.*.result, 'failure') }}" = "true" ] ||
   exit 1
 fi`;
 
-function prologue(): string {
-  return renderSteps(
-    [
-      { uses: CHECKOUT },
-      { uses: SETUP_BUN, with: { 'bun-version': BUN_VERSION } },
-      { run: 'bun install --frozen-lockfile' },
-    ],
-    3,
-  );
+const NODE_NOTE = `      # ⛔ REAL NODE, NOT BUN'S SHIM, AND ONLY WHERE THE GATE NEEDS IT. The mini's job
+      #   image has no node on PATH (ubuntu-latest always did), so a repository whose own
+      #   \`check\` spawns \`node\` — or whose framework demands a Node runtime — fails with
+      #   \`Executable not found in $PATH: "node"\` without this. Declared as \`node:\` in
+      #   repo-shape.ts, so it is one input rather than a hand-edited block per repository.
+      # ⚠️ NO PACKAGE-MANAGER CACHE: bun does the installing, so priming npm's cache costs
+      #   time and caches nothing anything here reads.`;
+
+function prologue(shape: RepoShape): string {
+  const node = nodeMajor(shape);
+  const bun: JobStep[] = [
+    { uses: SETUP_BUN, with: { 'bun-version': BUN_VERSION } },
+    { run: 'bun install --frozen-lockfile' },
+  ];
+  if (node === undefined) return renderSteps([{ uses: CHECKOUT }, ...bun], 3);
+  return [
+    renderSteps([{ uses: CHECKOUT }], 3),
+    NODE_NOTE,
+    renderSteps(
+      [{ uses: SETUP_NODE, with: { 'node-version': node, 'package-manager-cache': 'false' } }],
+      3,
+    ),
+    renderSteps(bun, 3),
+  ].join('\n');
 }
 
-function renderExtraJob(job: ExtraJob, on: string): string {
+function renderExtraJob(job: ExtraJob, shape: RepoShape, on: string): string {
   const needs =
     (job.needs ?? []).length === 0 ? '' : `    needs: [${(job.needs ?? []).join(', ')}]\n`;
+  // ★ A TIMEOUT IS THE JOB'S, NOT THE SHAPE'S. Only a job that starts something with its
+  //   own wait needs one, and it is rendered where a reader looks for it.
+  const timeout = job.timeout === undefined ? '' : `    timeout-minutes: ${job.timeout}\n`;
   const steps =
     job.bun === false
       ? renderSteps([{ uses: CHECKOUT }, ...job.steps], 3)
-      : [prologue(), renderSteps(job.steps, 3)].join('\n');
+      : [prologue(shape), renderSteps(job.steps, 3)].join('\n');
   // ★ The stated reason is rendered into the file. A job nobody can explain is a job
   //   nobody dares delete, so the explanation travels with it.
   return `  # ★ NOT PART OF THE STANDARD SHAPE — ${job.reason}
   ${job.id}:
     name: ${job.name}
 ${needs}    runs-on: ${on}
-    steps:
+${timeout}    steps:
 ${steps}
 `;
 }
@@ -190,7 +209,7 @@ ${CHECK_NOTE}
     name: check
     runs-on: ${on}
     steps:
-${prologue()}
+${prologue(shape)}
 ${renderSteps([{ run: 'bun run check' }], 3)}
 
 ${WORKFLOWS_NOTE}
@@ -203,7 +222,7 @@ ${ACTIONLINT_NOTE}
 ${renderSteps([{ name: 'Install actionlint (checksum-verified)', run: INSTALL_ACTIONLINT }], 3)}
 ${renderSteps([{ name: 'Lint workflows', run: './actionlint -color' }], 3)}
 
-${extras.map((job) => `${renderExtraJob(job, on)}\n`).join('')}${AGGREGATE_NOTE}
+${extras.map((job) => `${renderExtraJob(job, shape, on)}\n`).join('')}${AGGREGATE_NOTE}
   ci:
     name: ci
     if: always()

package/src/repo-shape/companions.ts

@@ -1,6 +1,6 @@
 /**
- * The three smaller rendered files: actionlint's config, the changeset config, and
- * Dependabot.
+ * The two smaller rendered files: actionlint's config and the changeset config.
+ * (Dependabot was the third; it grew a group and a schedule rule, so it is `dependabot.ts`.)
  *
  * ★ EACH ONE WAS MEASURED BEFORE IT WAS RENDERED (2026-09-22, across 13 repositories):
  *     · `.changeset/config.json` — byte-identical apart from the repository name in 11 of
@@ -10,8 +10,6 @@
  *     · `.github/actionlint.yaml` — 12 of 13 had it, with three wordings of one comment.
  *       The one without it is the one repository still on `ubuntu-latest`, which is the
  *       only case where it is genuinely not needed. That is an input, not an exception.
- *     · `.github/dependabot.yml` — 1 of 14. Twelve repositories take no dependency or
- *       Action updates at all, and nothing said so. Rendering it is the fix.
  */
 import type { RepoShape } from './shape.ts';
 
@@ -76,76 +74,3 @@ self-hosted-runner:
     - homeflare-mini
 `;
 }
-
-/** `.github/dependabot.yml`. */
-export function renderDependabot(shape: RepoShape): string {
-  // ⚠️ `directories`, not `directory`, for bun: a workspace keeps a dependency in the
-  //   package that declares it, so pointing only at `/` leaves every `packages/*`
-  //   manifest unwatched — and the symptom is silence, not an error.
-  const bunDirs = shape.publishes ? ['/', '/packages/*'] : ['/'];
-  return `# Dependabot for ${shape.repository}.
-#
-# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.
-#    Refresh with \`bun run repo-shape:refresh\`.
-#
-# ⛔ THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
-#   platform feature, not an Action — a config placed among the workflows is silently
-#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
-#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
-#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
-#
-# ★ WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
-#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
-#   that is either safe to take together or needs deciding together.
-version: 2
-
-updates:
-  # ── The toolchain (bun.lock) ────────────────────────────────────────────────
-  - package-ecosystem: bun
-    directories:
-${bunDirs.map((dir) => `      - ${dir}`).join('\n')}
-    schedule:
-      interval: weekly
-      day: monday
-      time: '09:00'
-      timezone: America/New_York
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'chore'
-      include: scope
-    labels: [dependencies]
-    groups:
-      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
-      # noise unless they fail CI, which is what CI is for.
-      lint-and-format:
-        patterns: ['oxfmt', 'oxlint']
-        update-types: [minor, patch]
-
-      # ⚠️ MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
-      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
-      #   did both). These want reading, not merging on green.
-      build-tooling:
-        patterns: ['typescript', '@changesets/*', '@types/bun']
-        update-types: [minor, patch]
-
-  # ── The workflows themselves ────────────────────────────────────────────────
-  # ★ Actions go stale invisibly: nothing fails, they just keep running old code. The
-  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
-  #   (current: v2, with every input renamed) — measured 2026-09-15.
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: '09:00'
-      timezone: America/New_York
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'ci'
-    labels: [dependencies, github-actions]
-    groups:
-      actions:
-        patterns: ['*']
-        update-types: [minor, patch]
-`;
-}