mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 10:37:21 +09:00
Myasnikov Daniil
ac56d4cea1
Raise the OpenSSF Scorecard Dependency-Update-Tool check (was 0/10) by adding a Renovate config. Renovate is already the cozystack org standard (active on ansible-cozystack, talm, boot-to-talos), so the app is authorized org-wide and this file is picked up without a new credential. Scoped deliberately so automated bumps only ever touch Go dependencies: - enabledManagers: [gomod] — Renovate ignores Dockerfiles, Helm charts, shipped component/operator versions, and GitHub Actions. Components and images stay hand-managed, per the 2026-05-27 decision. - gomodTidy + gomodUpdateImportPaths run after each bump; the gomod manager auto-discovers both the root module and the api/apps/v1alpha1 submodule. - controller-runtime and k8s.io/** are grouped so client-go and controller-runtime never bump out of lockstep. - The Go toolchain directive is pinned (matchDepTypes golang disabled): go.mod is generated and a toolchain bump needs a matching setup-go and a codegen run, out of scope for an automated PR. - automerge/platformAutomerge are off and every Renovate PR is labeled do-not-merge/hold + automated, so bumps are held until tests pass and a maintainer reviews them by hand. Validated with renovate-config-validator (config validated successfully). Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
28 lines
1.1 KiB
JSON
28 lines
1.1 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":semanticCommits"
|
|
],
|
|
"enabledManagers": ["gomod"],
|
|
"postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
|
|
"labels": ["automated", "do-not-merge/hold"],
|
|
"automerge": false,
|
|
"platformAutomerge": false,
|
|
"prConcurrentLimit": 5,
|
|
"packageRules": [
|
|
{
|
|
"description": "Keep controller-runtime and the Kubernetes libraries in lockstep. A split bump breaks compilation because a given controller-runtime release expects a matching client-go / apimachinery line.",
|
|
"groupName": "kubernetes",
|
|
"matchManagers": ["gomod"],
|
|
"matchPackageNames": ["sigs.k8s.io/controller-runtime", "k8s.io/**"]
|
|
},
|
|
{
|
|
"description": "Never bump the Go toolchain directive. go.mod is generated and the toolchain is pinned deliberately; raising it needs a matching setup-go and a codegen run, which is out of scope for an automated dependency bump.",
|
|
"matchManagers": ["gomod"],
|
|
"matchDepTypes": ["golang"],
|
|
"enabled": false
|
|
}
|
|
]
|
|
}
|