stack/renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "labels": ["dependencies"],
  "automerge": false,
  "automergeType": "branch",
  "automergeStrategy": "fast-forward",
  "prHourlyLimit": 0,
  "minimumReleaseAge": "7 days",
  "fetchChangeLogs": "off",
  "ignorePaths": [
    "**/node_modules/**",
    "**/bower_components/**",
    "**/vendor/**",
    "**/examples/**",
    "**/__tests__/**",
    "**/test/**",
    "**/tests/**",
    "**/__fixtures__/**",
    "infra/traefik/plugins/src/**"
  ],
  "osvVulnerabilityAlerts": true,
  "vulnerabilityAlerts": {
    "labels": ["dependencies", "security"]
  },
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 6am on monday"]
  },
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
      "automerge": true
    },
    {
      "description": "A Python minor (3.13 -> 3.15) is a runtime migration, not a patch: never automerge it.",
      "matchDepNames": ["python"],
      "automerge": false
    },
    {
      "description": "pymupdf 2.x bundles the Polyform-Noncommercial layout code and onnxruntime — a licence decision (see pyproject.toml), not a routine bump.",
      "matchPackageNames": ["pymupdf"],
      "allowedVersions": "<2"
    },
    {
      "description": "Action pins (uses: …@v4) are github-tags lookups, which Renovate refuses without a GITHUB_COM_TOKEN; and all workflows but renovate.yml are generated by gen_config.py from dev/scripts/backends/*.py, so a direct edit would fail its --check. The Renovate container image (docker datasource) stays tracked.",
      "matchManagers": ["github-actions"],
      "matchDatasources": ["github-tags"],
      "enabled": false
    },
    {
      "description": "requires-python is a support floor, not a dependency to bump.",
      "matchManagers": ["pep621"],
      "matchDepNames": ["python"],
      "enabled": false
    },
    {
      "description": "Every service shares the same .duckdb files; a new duckdb major is a coordinated migration, not a bump (see pyproject's notebooks extra).",
      "matchPackageNames": ["duckdb"],
      "allowedVersions": "<2"
    },
    {
      "description": "dev/scripts/marimo_latest.py (nightly timer) owns the notebooks image's marimo pin end to end: bump, build, gate, roll. A Renovate bump would land the pin without rolling, and the timer would then see it as current.",
      "matchDepNames": ["marimo-team/marimo"],
      "enabled": false
    },
    {
      "description": "Generated-workflow tool pins: gen_config.py must re-emit .gitea/workflows after the bump, so a human merges these.",
      "matchFileNames": ["dev/scripts/backends/gitea.py"],
      "automerge": false,
      "prBodyNotes": ["Run `uv run python dev/scripts/gen_config.py` on this branch and commit the regenerated workflows before merging."]
    }
  ],
  "dockerfile": {
    "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"]
  },
  "customManagers": [
    {
      "customType": "regex",
      "description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (yq, otel-cli, …) that the dockerfile manager can't see. Tools that publish a Docker image are tracked through it (datasource=docker): github-* datasources need a GITHUB_COM_TOKEN.",
      "managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: extractVersion=(?<extractVersion>\\S+))?\\s+ARG \\w+?_VERSION=(?<currentValue>\\S+)"
      ]
    },
    {
      "customType": "regex",
      "description": "Bump the trivy/crane pins the CI workflow generator installs.",
      "managerFilePatterns": ["/^dev/scripts/backends/gitea\\.py$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+\\w+_VERSION = \"(?<currentValue>[^\"]+)\""
      ],
      "extractVersionTemplate": "^v?(?<version>.*)$"
    }
  ]
}