ci: limit renovate PR count and enable versionCode bump on release

.github/workflows/formulus-android.yml

@@ -19,7 +19,6 @@ on:
       - 'packages/tokens/**'
       - 'packages/components/**'
       - 'packages/observation-query/**'
-      - '.github/workflows/formulus-android.yml'
   release:
     types: [published]
 
@@ -83,6 +82,7 @@ jobs:
     needs: build-formplayer-assets
     permissions:
       contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout repository
@@ -250,3 +250,13 @@ jobs:
             formulus/android/app/build/outputs/bundle/release/*.aab
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  prepare-next-native-build-code:
+    name: Prepare next Formulus build code
+    if: github.event_name == 'release' && needs.build-android.result == 'success'
+    needs: build-android
+    uses: ./.github/workflows/prepare-next-formulus-build-code.yml
+    with:
+      target_branch: ${{ github.event.release.target_commitish }}
+      dry_run: false
+    secrets: inherit

.github/workflows/prepare-next-formulus-build-code.yml

@@ -13,6 +13,17 @@ on:
         required: true
         default: true
         type: boolean
+  workflow_call:
+    inputs:
+      target_branch:
+        description: Branch that the release was prepared from and that should receive the next-code PR
+        required: true
+        type: string
+      dry_run:
+        description: Validate and show the proposed update without creating a branch or pull request
+        required: false
+        default: false
+        type: boolean
 
 concurrency:
   group: prepare-next-formulus-build-code-${{ inputs.target_branch }}
@@ -28,6 +39,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Verify target branch
+        env:
+          TARGET_BRANCH: ${{ inputs.target_branch }}
+        run: |
+          case "$TARGET_BRANCH" in
+            dev|main) ;;
+            *)
+              echo "::error::Target branch must be dev or main; received '$TARGET_BRANCH'."
+              echo "Create releases from one of those branches so the next-code PR has a safe target."
+              exit 1
+              ;;
+          esac
+
       - name: Checkout target branch
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:

renovate.json

@@ -1,9 +1,12 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ],
+  "extends": ["config:recommended"],
   "labels": ["dependencies"],
+  "dependencyDashboard": true,
+  "branchConcurrentLimit": 2,
+  "prConcurrentLimit": 2,
+  "prHourlyLimit": 1,
+  "minimumReleaseAge": "3 days",
   "lockFileMaintenance": {
     "enabled": false
   },
@@ -17,6 +20,35 @@
       "matchFileNames": ["formulus/package.json"],
       "rangeStrategy": "bump"
     },
+    {
+      "description": "Group non-major JavaScript dependency updates",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "groupName": "npm non-major dependencies"
+    },
+    {
+      "description": "Group non-major Rust dependency updates",
+      "matchManagers": ["cargo"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "Rust non-major dependencies"
+    },
+    {
+      "description": "Group non-major Go dependency updates",
+      "matchManagers": ["gomod"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "Go non-major dependencies"
+    },
+    {
+      "description": "Group GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch", "digest"],
+      "groupName": "GitHub Actions updates"
+    },
+    {
+      "description": "Keep major updates separate and manually reviewed",
+      "matchUpdateTypes": ["major"],
+      "automerge": false
+    },
     {
       "description": "Automerge patch and digest updates only after required CI status checks pass",
       "matchUpdateTypes": ["patch", "digest"],