x509-certificate-exporter/renovate.json5

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",

  extends: [
    "config:recommended",
    ":dependencyDashboard",
  ],

  // Conventional Commits — release-please reads these from main to compute
  // the next SemVer bump and slot bumps under the right CHANGELOG section.
  //
  // Default Renovate output is `chore(deps): update X` which is HIDDEN from
  // the public changelog by our release-please config. We want bumps to land
  // under "Dependencies" instead, so use `deps:` as the type and drop the
  // redundant `(deps)` scope. The matching changelog mapping is in
  // release-please-config.json.
  semanticCommits: "enabled",
  semanticCommitType: "deps",
  semanticCommitScope: null,

  // Defaults are conservative (10 concurrent, 2/hour) to protect heavily
  // multi-tenant Renovate hosts from spamming reviewers. We self-host on
  // GHA and control the cron, so the anti-spam guard isn't load-bearing
  // — bump both to 20 so Dependency Dashboard checkbox approvals
  // materialize in one run instead of dripping over hours.
  prConcurrentLimit: 20,
  prHourlyLimit: 20,

  // config:recommended inherits prCreation:"not-pending" (open PR only after
  // branch CI is green, on the next Renovate run). Override globally so every
  // PR is opened in the same run that creates the branch.
  prCreation: "immediate",

  // Trigger cadence is daily (see .github/workflows/renovate.yaml) so security
  // alerts are detected within 24 h, but routine bumps are batched once a week
  // on Monday to avoid drowning reviewers in mid-week churn. Vulnerability
  // alerts override this below with `schedule: "at any time"`.
  schedule: ["on monday"],
  timezone: "Europe/Paris",

  vulnerabilityAlerts: {
    enabled: true,
    labels: ["security"],
    // Explicit bypass of the top-level Monday schedule — the docs don't
    // guarantee an implicit override, and users have hit cases where security
    // PRs got blocked by the global schedule (renovatebot#14289).
    schedule: "at any time",
    // Routes the commit to release-please's "Security Updates" section
    // instead of "Dependencies".
    semanticCommitType: "security",
  },
  osvVulnerabilityAlerts: true,

  // Refresh flake.lock and transitive go.sum entries every time Renovate
  // runs. Inherits the top-level Monday schedule.
  lockFileMaintenance: {
    enabled: true,
  },

  customManagers: [
    // K3s image pinned for both the dev cluster bootstrap and the
    // throwaway e2e cluster (Taskfile var K3S_IMAGE). Tag format
    // `v<sem>-k3s<n>`.
    //
    // The regex tolerates YAML quoting variants: bare value, single
    // quotes, double quotes — whichever a formatter happens to apply.
    // No anchor after currentValue, so any future `@digest` suffix is
    // silently ignored without breaking extraction.
    {
      customType: "regex",
      managerFilePatterns: ["/^Taskfile\\.ya?ml$/"],
      matchStrings: [
        "K3S_IMAGE:\\s*['\"]?rancher/k3s:(?<currentValue>v\\d+\\.\\d+\\.\\d+-k3s\\d+)",
      ],
      depNameTemplate: "rancher/k3s",
      datasourceTemplate: "docker",
      versioningTemplate: "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-k3s(?<build>\\d+)$",
    },
    // kube-prometheus-stack chart pinned in the dev Tiltfile
    // (KUBE_PROMETHEUS_VERSION). Pulled from prometheus-community's
    // OCI registry on ghcr.io.
    //
    // The regex tolerates two formatting variants:
    //
    //   - inline    : `KUBE_PROMETHEUS_VERSION = "x.y.z"`
    //   - paren-wrap: `KUBE_PROMETHEUS_VERSION = (\n  "x.y.z"\n)` (IDE auto-format)
    //
    // `\s*` matches newlines and `\(?` makes the opening paren
    // optional. The currentValue is bare semver — no `@digest` suffix
    // because helm pulls OCI charts via the URL-form for digest pinning,
    // not via `--version`. The closing paren is intentionally outside
    // the match so `replaceString` stops at the closing quote.
    {
      customType: "regex",
      managerFilePatterns: ["/^Tiltfile$/"],
      matchStrings: [
        "KUBE_PROMETHEUS_VERSION\\s*=\\s*\\(?\\s*['\"](?<currentValue>\\d[\\w.-]*)['\"]",
      ],
      depNameTemplate: "kube-prometheus-stack",
      datasourceTemplate: "docker",
      packageNameTemplate: "ghcr.io/prometheus-community/charts/kube-prometheus-stack",
    },
    // Container images and tool versions pinned as Go constants in the
    // Dagger module's base.go (golang/alpine/helm/renovate/helm-docs
    // images, golangci-lint and gotestsum tool versions). Two regex
    // managers — one for Docker images, one for `go install` tools —
    // since the datasource differs.
    //
    // The Docker regex captures `currentDigest` separately from
    // `currentValue` so the global `pinDigests: true` rule (under
    // matchCategories: ["docker"]) can write back `image:tag@sha256:...`
    // — these images run our CI/release sandbox and inherit the
    // associated tokens, so they're a real supply-chain target.
    // `autoReplaceStringTemplate` is set explicitly because the default
    // regex-manager template doesn't preserve the surrounding
    // `<name>Image = "..."` Go-source structure. gofmt re-aligns the
    // const block on the next save once digests land.
    {
      customType: "regex",
      managerFilePatterns: ["/^dagger/base\\.go$/"],
      matchStrings: [
        "(?<depName>[a-zA-Z0-9./_-]+)Image\\s*=\\s*\"(?<packageName>[a-zA-Z0-9./_-]+):(?<currentValue>[\\w.-]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\"",
      ],
      autoReplaceStringTemplate: "{{depName}}Image = \"{{packageName}}:{{newValue}}{{#if newDigest}}@{{newDigest}}{{/if}}\"",
      datasourceTemplate: "docker",
    },
    {
      customType: "regex",
      managerFilePatterns: ["/^dagger/base\\.go$/"],
      matchStrings: [
        "golangciLint\\s*=\\s*\"(?<currentValue>v\\d[\\w.-]*)\"",
      ],
      depNameTemplate: "github.com/golangci/golangci-lint/v2",
      datasourceTemplate: "go",
    },
    {
      customType: "regex",
      managerFilePatterns: ["/^dagger/base\\.go$/"],
      matchStrings: [
        "gotestsumModule\\s*=\\s*\"(?<currentValue>v\\d[\\w.-]*)\"",
      ],
      depNameTemplate: "gotest.tools/gotestsum",
      datasourceTemplate: "go",
    },
  ],

  packageRules: [
    // Pin digests on the production-shipping Dockerfiles (chart-published
    // images and seed-hostpath e2e image) AND on the dagger/base.go
    // const block (CI / release sandbox images that inherit our tokens
    // — real supply-chain target).
    //
    // Explicitly NOT in scope: the Taskfile K3S_IMAGE (dev + e2e
    // cluster bootstrap, ephemeral) and the Tiltfile
    // KUBE_PROMETHEUS_VERSION (dev-cluster prometheus operator).
    // Both are dev tooling whose
    // digest churn would just produce refresh-PRs without any sec gain.
    //
    // matchFileNames is the scoping knob — matchDatasources alone would
    // pull in the dev regex managers too (since they also resolve via
    // datasource=docker). matchCategories was used previously but doesn't
    // propagate consistently to custom.regex managers across Renovate
    // versions.
    {
      matchDatasources: ["docker"],
      matchFileNames: ["build/Dockerfile.*", "dagger/base.go"],
      pinDigests: true,
    },
    // Pin GitHub Actions to commit SHAs. Renovate will rewrite floating
    // tags (e.g. `actions/checkout@v4`) to `@<sha> # v4` on its next run,
    // and keep them pinned thereafter.
    {
      matchManagers: ["github-actions"],
      pinDigests: true,
    },

    // Single PR for all Go-toolchain bumps: go.mod's `go X.Y.Z` and the
    // dagger/base.go `golangImage` constant land together. CI workflows
    // resolve the Go version via `setup-go` + `go-version-file: go.mod`,
    // so they need no separate bump. flake.nix is intentionally unpinned
    // (GOTOOLCHAIN=auto downloads the toolchain declared in go.mod), so
    // no manual edit there either.
    {
      matchPackageNames: ["golang", "go"],
      groupName: "golang toolchain",
      commitMessageTopic: "Go toolchain",
      labels: ["dependencies", "golang"],
    },
    // Major Go-toolchain bumps require manual approval via the dashboard.
    {
      matchPackageNames: ["golang", "go"],
      matchUpdateTypes: ["major"],
      dependencyDashboardApproval: true,
    },

    // Group all variant base images (busybox, alpine, registry) together.
    {
      matchPackageNames: ["busybox", "alpine", "registry"],
      groupName: "container base images",
      labels: ["dependencies", "docker"],
    },

    // Go modules: split patch / minor into two predictable PRs.
    {
      matchManagers: ["gomod"],
      matchUpdateTypes: ["patch"],
      groupName: "go modules (patch)",
      labels: ["dependencies", "go"],
    },
    {
      matchManagers: ["gomod"],
      matchUpdateTypes: ["minor"],
      groupName: "go modules (minor)",
      labels: ["dependencies", "go"],
    },

    // One rolling PR for GitHub Actions bumps.
    {
      matchManagers: ["github-actions"],
      groupName: "github-actions",
      labels: ["dependencies", "ci"],
    },

    // Nix flake lock maintenance.
    {
      matchManagers: ["nix"],
      groupName: "nix flake inputs",
      labels: ["dependencies", "nix"],
    },
  ],
}