From 960563f66aa06c034667ef56c3da25b642121582 Mon Sep 17 00:00:00 2001
From: Gauvain <contact@uruk.dev>
Date: Wed, 10 Jun 2026 01:14:38 +0200
Subject: [PATCH] fix(renovate): resolve maven lookups and unnest misplaced
 config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add a packageRule routing the maven datasource through Google's Maven
  repo so androidx packages (androidx.tvprovider, androidx.core-ktx) in
  modules/tv-recommendations resolve instead of failing with no-result.
- Move vulnerabilityAlerts and the GitHub-Actions grouping packageRule
  out of lockFileMaintenance (where they were dead) to the top level so
  they take effect. lockFileMaintenance stays enabled via the
  config:best-practices preset (:maintainLockFilesWeekly) — unchanged.

Addresses the package-lookup warnings in the Dependency Dashboard (#724).
---
 .github/renovate.json | 40 +++++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index fdbe3734d..258db55d1 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -44,22 +44,28 @@
       ]
     }
   },
-  "lockFileMaintenance": {
-    "vulnerabilityAlerts": {
-      "enabled": true,
-      "addLabels": ["security", "vulnerability"],
-      "assigneesFromCodeOwners": true,
-      "commitMessageSuffix": " [SECURITY]"
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "addLabels": ["security", "vulnerability"],
+    "assigneesFromCodeOwners": true,
+    "commitMessageSuffix": " [SECURITY]"
+  },
+  "packageRules": [
+    {
+      "description": "Group minor and patch GitHub Action updates into a single PR",
+      "matchManagers": ["github-actions"],
+      "groupName": "CI dependencies",
+      "groupSlug": "ci-deps",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true
     },
-    "packageRules": [
-      {
-        "description": "Group minor and patch GitHub Action updates into a single PR",
-        "matchManagers": ["github-actions"],
-        "groupName": "CI dependencies",
-        "groupSlug": "ci-deps",
-        "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
-        "automerge": true
-      }
-    ]
-  }
+    {
+      "description": "androidx and other Google-hosted Maven packages resolve from Google's Maven repository (not Maven Central)",
+      "matchDatasources": ["maven"],
+      "registryUrls": [
+        "https://dl.google.com/dl/android/maven2/",
+        "https://repo.maven.apache.org/maven2/"
+      ]
+    }
+  ]
 }