bf4115195d
28 weekly Renovate runs were green and opened zero PRs: the log says "No repositories found" — RENOVATE_REPOSITORIES was never set, so every run exited before looking at the repo. Dependency drift went unwatched for its whole life. Workflow: self-hosted settings move to env where they belong (RENOVATE_PLATFORM/ENDPOINT/REPOSITORIES); the image is pinned (44.171.1) instead of `latest`, and Renovate bumps that pin itself. renovate.json: - fileMatch -> managerFilePatterns (Renovate 41+ migration; its own suggested rewrite of the Dockerfile glob was not a valid regex). - Drop the pip_requirements-on-pyproject.toml mapping; the default pep621 manager owns pyproject.toml + uv.lock. - minimumReleaseAge 7 days (matches the uv cooldown); osvVulnerabilityAlerts with a `security` label; weekly lockFileMaintenance. - Guards on the minor/patch automerge: Python 3.13 -> 3.15 counts as a "minor" and would have automerged; pymupdf stays <2 (licence); tool-pin bumps in backends/gitea.py need gen_config.py re-run, so a human merges those. - github-actions manager limited to renovate.yml — the rest of .gitea/workflows is generated. Validated with renovate-config-validator --strict; a local dry run (--platform=local --dry-run=lookup) proposes 25 updates, e.g. traefik v3.3 -> v3.7, coredns 1.12 -> 1.14.7, tempo 2.7.2 -> 2.10.10, CUDA 12.6 -> 12.9.2. Lookups of github-releases deps want a GITHUB_COM_TOKEN secret to avoid anonymous rate limits. Refs #1365
64 lines
2.5 KiB
JSON
64 lines
2.5 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended"],
|
|
"labels": ["dependencies"],
|
|
"automerge": false,
|
|
"minimumReleaseAge": "7 days",
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"labels": ["dependencies", "security"]
|
|
},
|
|
"lockFileMaintenance": {
|
|
"enabled": true,
|
|
"schedule": ["before 6am on monday"]
|
|
},
|
|
"packageRules": [
|
|
{
|
|
"matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
|
|
"automerge": true
|
|
},
|
|
{
|
|
"description": "A Python minor (3.13 -> 3.15) is a runtime migration, not a patch: never automerge it.",
|
|
"matchDepNames": ["python"],
|
|
"automerge": false
|
|
},
|
|
{
|
|
"description": "pymupdf 2.x bundles the Polyform-Noncommercial layout code and onnxruntime — a licence decision (see pyproject.toml), not a routine bump.",
|
|
"matchPackageNames": ["pymupdf"],
|
|
"allowedVersions": "<2"
|
|
},
|
|
{
|
|
"description": "Generated-workflow tool pins: gen_config.py must re-emit .gitea/workflows after the bump, so a human merges these.",
|
|
"matchFileNames": ["dev/scripts/backends/gitea.py"],
|
|
"automerge": false,
|
|
"prBodyNotes": ["Run `uv run python dev/scripts/gen_config.py` on this branch and commit the regenerated workflows before merging."]
|
|
}
|
|
],
|
|
"dockerfile": {
|
|
"managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"]
|
|
},
|
|
"github-actions": {
|
|
"description": "Only the hand-written Renovate workflow; the rest of .gitea/workflows is generated by gen_config.py.",
|
|
"managerFilePatterns": ["/^\\.gitea/workflows/renovate\\.yml$/"]
|
|
},
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (marimo, yq, otel-cli, …) that the dockerfile manager can't see.",
|
|
"managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"],
|
|
"matchStrings": [
|
|
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: extractVersion=(?<extractVersion>\\S+))?\\s+ARG \\w+?_VERSION=(?<currentValue>\\S+)"
|
|
]
|
|
},
|
|
{
|
|
"customType": "regex",
|
|
"description": "Bump the trivy/crane pins the CI workflow generator installs.",
|
|
"managerFilePatterns": ["/^dev/scripts/backends/gitea\\.py$/"],
|
|
"matchStrings": [
|
|
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+\\w+_VERSION = \"(?<currentValue>[^\"]+)\""
|
|
],
|
|
"extractVersionTemplate": "^v?(?<version>.*)$"
|
|
}
|
|
]
|
|
}
|