cozystack/.github/renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":semanticCommits"
  ],
  "enabledManagers": ["gomod", "dockerfile", "github-actions", "custom.regex"],
  "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
  "labels": ["automated", "do-not-merge/hold"],
  "semanticCommitType": "chore",
  "semanticCommitScope": "deps",
  "automerge": false,
  "platformAutomerge": false,
  "prConcurrentLimit": 5,
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["automated", "security"]
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "Track the etcd image pinned in the extra/etcd EtcdCluster podTemplate. etcd-operator v0.4.5 bakes etcd 3.5.12 into its binary, and the chart overrides it with a hardcoded image string that the gomod/dockerfile managers cannot see. Without this manager the security-relevant pin (etcd 3.5.x releases are overwhelmingly security fixes) would silently age.",
      "managerFilePatterns": ["/^packages/extra/etcd/templates/etcd-cluster\\.yaml$/"],
      "matchStrings": ["image:\\s+(?<depName>quay\\.io/coreos/etcd):(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"],
      "datasourceTemplate": "docker"
    },
    {
      "customType": "regex",
      "description": "Track and keep fresh the clastix/kubectl image digest-pinned in the post-delete cleanup hooks. The ref is assembled at render time by the cozy-lib.image helper (routed through cozy-lib.images-registry so mirrored / air-gapped installs resolve it), so it is neither a Dockerfile nor a go.mod dependency and the built-in managers cannot see it. The helm-values manager is disabled repo-wide (see enabledManagers above), so without this regex manager the digest — a supply-chain pin — would silently age.",
      "managerFilePatterns": ["/^packages/.+/templates/hooks/.+\\.yaml$/"],
      "matchStrings": ["clastix/kubectl:(?<currentValue>v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?)@(?<currentDigest>sha256:[a-f0-9]+)"],
      "datasourceTemplate": "docker",
      "depNameTemplate": "docker.io/clastix/kubectl"
    }
  ],
  "packageRules": [
    {
      "description": "Force chore(deps) for all Go module bumps. config:recommended pulls in :semanticPrefixFixDepsChoreOthers, whose packageRule re-sets semanticCommitType=fix for direct deps (depType require), overriding the top-level chore. packageRules override top-level config, so a user rule evaluated last is required to win it back; without this, direct-dep PRs land as fix(deps) and get auto-labeled kind/bug.",
      "matchManagers": ["gomod"],
      "semanticCommitType": "chore",
      "semanticCommitScope": "deps"
    },
    {
      "description": "Bump indirect Go modules too. Transitive deps such as golang.org/x/crypto, golang.org/x/net and golang.org/x/sys carry OSV advisories that drive the OpenSSF Scorecard Vulnerabilities check to 0, but Renovate skips indirect gomod deps by default so they never get a PR. Grouped into one rolling PR to keep volume sane; security fixes are still split out by vulnerabilityAlerts above. Placed before the kubernetes rule on purpose: an indirect k8s.io/** dep matches both, and Renovate applies last-match-wins, so the later kubernetes rule keeps it in the kubernetes lockstep group.",
      "matchManagers": ["gomod"],
      "matchDepTypes": ["indirect"],
      "enabled": true,
      "groupName": "indirect go modules"
    },
    {
      "description": "Keep controller-runtime and the Kubernetes libraries in lockstep. A split bump breaks compilation because a given controller-runtime release expects a matching client-go / apimachinery line.",
      "groupName": "kubernetes",
      "matchManagers": ["gomod"],
      "matchPackageNames": ["sigs.k8s.io/controller-runtime", "k8s.io/**"]
    },
    {
      "description": "Never bump the Go toolchain directive. go.mod is generated and the toolchain is pinned deliberately; raising it needs a matching setup-go and a codegen run, which is out of scope for an automated dependency bump.",
      "matchManagers": ["gomod"],
      "matchDepTypes": ["golang"],
      "enabled": false
    },
    {
      "description": "Pin Dockerfile base images and GitHub Actions to immutable digests so OpenSSF Scorecard Pinned-Dependencies passes and supply-chain refs stay reproducible. The tag is kept in front of the digest so it stays human-readable and trackable.",
      "matchManagers": ["dockerfile", "github-actions"],
      "pinDigests": true
    },
    {
      "description": "Batch the initial pin and all digest-only refreshes (same tag, rebuilt upstream) into a single weekly PR. Without this, frequently-rebuilt bases (alpine, debian, golang, distroless) would trickle in one rebuild-triggering PR each, loading the shared CI runner. Real tag bumps (major/minor/patch) are intentionally left out of this group so they get individual review.",
      "matchManagers": ["dockerfile", "github-actions"],
      "matchUpdateTypes": ["digest", "pinDigest"],
      "groupName": "container image & action digests",
      "schedule": ["before 6am on monday"]
    },
    {
      "description": "The Harbor rebuilds reproduce one upstream release, so their build bases follow upstream's Makefile at that tag (GOBUILDIMAGE, NODEBUILDIMAGE) rather than the newest image. A golang tag bump builds Harbor with a toolchain upstream never shipped it with, and a node major breaks the Angular portal build. Tag bumps are disabled here; digest refreshes of the same tag still arrive through the digest group above. Move the tags by hand with HARBOR_VERSION.",
      "matchManagers": ["dockerfile"],
      "matchFileNames": ["packages/system/harbor/images/**"],
      "matchUpdateTypes": ["major", "minor", "patch"],
      "enabled": false
    },
    {
      "description": "The cilium-operator rebuild compiles one upstream release with the Go toolchain upstream's builder image pins at that tag, and `make update` in packages/system/cilium re-pins the builder line from there. A Renovate bump, by tag or by digest, builds with a toolchain upstream never shipped the release with, and the next `make update` silently reverts it. The operator-generic base stage and its VERSION and UPSTREAM_DIGEST args are pinned by the same recipe, and VERSION also selects the source archive SOURCE_SHA256 checks. Updates are disabled here; all of them move with the Cilium version.",
      "matchManagers": ["dockerfile"],
      "matchFileNames": ["packages/system/cilium/images/cilium-operator/**"],
      "enabled": false
    },
    {
      "description": "Split golang patch from minor updates for the e2e sandbox builder, so the rule below can drop the minor bump without taking the patch bump with it. By default both land in one non-major bucket and only the newest release is proposed.",
      "matchManagers": ["dockerfile"],
      "matchFileNames": ["packages/core/testing/images/e2e-sandbox/**"],
      "matchPackageNames": ["golang"],
      "separateMinorPatch": true
    },
    {
      "description": "The e2e sandbox builds a patched chainsaw release with the Go minor upstream shipped that release with. A golang minor or major bump builds it with a toolchain upstream never shipped it with. Patch and digest updates of the same minor still arrive; move the minor by hand together with CHAINSAW_VERSION.",
      "matchManagers": ["dockerfile"],
      "matchFileNames": ["packages/core/testing/images/e2e-sandbox/**"],
      "matchPackageNames": ["golang"],
      "matchUpdateTypes": ["major", "minor"],
      "enabled": false
    },
    {
      "description": "The seaweedfs rebuild compiles one upstream release with the Go toolchain upstream's docker/Dockerfile.go_build uses at that tag, lays it over the upstream image of that tag, and `make update` in packages/system/seaweedfs re-pins the builder, the base image digest and the source checksum from there. A Renovate bump of any of them builds a combination upstream never shipped, and the next `make update` silently reverts it. Updates are disabled here; all of them move with the SeaweedFS version.",
      "matchManagers": ["dockerfile"],
      "matchFileNames": ["packages/system/seaweedfs/images/seaweedfs/**"],
      "enabled": false
    },
    {
      "description": "kubevirt.io/csi-driver is pinned to an untagged pseudo-version commit and publishes no release tags, so Renovate's go datasource returns no-result and the lookup failure lingers on the Dependency Dashboard. Disable it; this module is advanced deliberately alongside the kubevirt-csi-driver image build.",
      "matchManagers": ["gomod"],
      "matchPackageNames": ["kubevirt.io/csi-driver"],
      "enabled": false
    }
  ]
}