fe949991d6
Some checks failed
CI / lint (push) Has been cancelled
CI / test (push) Has been cancelled
CI / notebooks-smoke (push) Has been cancelled
Deploy / changes (push) Has been cancelled
Deploy / notebooks (push) Has been cancelled
Deploy / zotero (push) Has been cancelled
Deploy / docs (push) Has been cancelled
Deploy / api (push) Has been cancelled
Deploy / bcda (push) Has been cancelled
Deploy / llm (push) Has been cancelled
Deploy / mc (push) Has been cancelled
Deploy / report (push) Has been cancelled
The only github-hosted deps left are the generated-workflow action pins and marimo, both disabled by packageRules (gen_config.py and marimo_latest.py own them). Renovate still lists them as needing a token, so the Dependency Dashboard kept a standing warning.
98 lines
3.9 KiB
JSON
98 lines
3.9 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended"],
|
|
"labels": ["dependencies"],
|
|
"automerge": false,
|
|
"automergeType": "branch",
|
|
"automergeStrategy": "fast-forward",
|
|
"prHourlyLimit": 0,
|
|
"minimumReleaseAge": "7 days",
|
|
"fetchChangeLogs": "off",
|
|
"githubTokenWarn": false,
|
|
"ignorePaths": [
|
|
"**/node_modules/**",
|
|
"**/bower_components/**",
|
|
"**/vendor/**",
|
|
"**/examples/**",
|
|
"**/__tests__/**",
|
|
"**/test/**",
|
|
"**/tests/**",
|
|
"**/__fixtures__/**",
|
|
"infra/traefik/plugins/src/**"
|
|
],
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"labels": ["dependencies", "security"]
|
|
},
|
|
"lockFileMaintenance": {
|
|
"enabled": true,
|
|
"schedule": ["before 6am on monday"]
|
|
},
|
|
"packageRules": [
|
|
{
|
|
"matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
|
|
"automerge": true
|
|
},
|
|
{
|
|
"description": "A Python minor (3.13 -> 3.15) is a runtime migration, not a patch: never automerge it.",
|
|
"matchDepNames": ["python"],
|
|
"automerge": false
|
|
},
|
|
{
|
|
"description": "pymupdf 2.x bundles the Polyform-Noncommercial layout code and onnxruntime — a licence decision (see pyproject.toml), not a routine bump.",
|
|
"matchPackageNames": ["pymupdf"],
|
|
"allowedVersions": "<2"
|
|
},
|
|
{
|
|
"description": "Action pins (uses: …@v4) are github-tags lookups, which Renovate refuses without a GITHUB_COM_TOKEN; and all workflows but renovate.yml are generated by gen_config.py from dev/scripts/backends/*.py, so a direct edit would fail its --check. The Renovate container image (docker datasource) stays tracked.",
|
|
"matchManagers": ["github-actions"],
|
|
"matchDatasources": ["github-tags"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "requires-python is a support floor, not a dependency to bump.",
|
|
"matchManagers": ["pep621"],
|
|
"matchDepNames": ["python"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "Every service shares the same .duckdb files; a new duckdb major is a coordinated migration, not a bump (see pyproject's notebooks extra).",
|
|
"matchPackageNames": ["duckdb"],
|
|
"allowedVersions": "<2"
|
|
},
|
|
{
|
|
"description": "dev/scripts/marimo_latest.py (nightly timer) owns the notebooks image's marimo pin end to end: bump, build, gate, roll. A Renovate bump would land the pin without rolling, and the timer would then see it as current.",
|
|
"matchDepNames": ["marimo-team/marimo"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "Generated-workflow tool pins: gen_config.py must re-emit .gitea/workflows after the bump, so a human merges these.",
|
|
"matchFileNames": ["dev/scripts/backends/gitea.py"],
|
|
"automerge": false,
|
|
"prBodyNotes": ["Run `uv run python dev/scripts/gen_config.py` on this branch and commit the regenerated workflows before merging."]
|
|
}
|
|
],
|
|
"dockerfile": {
|
|
"managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"]
|
|
},
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Bump `ARG *_VERSION=` pins annotated with a `# renovate:` comment (yq, otel-cli, …) that the dockerfile manager can't see. Tools that publish a Docker image are tracked through it (datasource=docker): github-* datasources need a GITHUB_COM_TOKEN.",
|
|
"managerFilePatterns": ["/(^|/)[^/]+\\.Dockerfile$/"],
|
|
"matchStrings": [
|
|
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)(?: extractVersion=(?<extractVersion>\\S+))?\\s+ARG \\w+?_VERSION=(?<currentValue>\\S+)"
|
|
]
|
|
},
|
|
{
|
|
"customType": "regex",
|
|
"description": "Bump the trivy/crane pins the CI workflow generator installs.",
|
|
"managerFilePatterns": ["/^dev/scripts/backends/gitea\\.py$/"],
|
|
"matchStrings": [
|
|
"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+\\w+_VERSION = \"(?<currentValue>[^\"]+)\""
|
|
],
|
|
"extractVersionTemplate": "^v?(?<version>.*)$"
|
|
}
|
|
]
|
|
}
|