renovate.jsonc

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests"
  ],
  // Pin container image digests for supply-chain safety. Registries that
  // prune untagged manifests (e.g. Fedora) must opt out via pinDigests:false
  // in their packageRule to avoid broken builds when the old digest disappears.
  "pinDigests": true,
  "postUpdateOptions": [
    "gomodTidy"
  ],
  "timezone": "Etc/UTC",
  "schedule": [
    "before 5am on monday"
  ],
  "labels": [
    "dependencies"
  ],
  "ignorePaths": [
    "**/vendor/**",
    "**/examples/**"
  ],
  "customManagers": [
    {
      // .go-version tracks go-toolset Docker tags, not golang-version releases.
      // Red Hat's go-toolset image is the Go version ceiling: it may lag behind
      // upstream Go releases by days or weeks, so .go-version must not outrun it
      // or container builds will reference a tag that does not exist yet.
      // The ubi10 registry enumerates Go-versioned tags (1.26.3, 1.25.8, ...)
      // alongside UBI-versioned tags (10.2, 10.1, ...); the versioning regex
      // selects only the Go-versioned ones.
      "description": "Track .go-version against go-toolset image tags (go-toolset is the Go version ceiling)",
      "customType": "regex",
      "managerFilePatterns": [
        "/(^|/)\\.go-version$/"
      ],
      "matchStrings": [
        "(?<currentValue>\\d+\\.\\d+\\.\\d+)\\n"
      ],
      "depNameTemplate": "registry.access.redhat.com/ubi10/go-toolset",
      "datasourceTemplate": "docker",
      "versioningTemplate": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
    },
    {
      "description": "Track .py-version for CI Python runtime (not the requires-python floor)",
      "customType": "regex",
      "managerFilePatterns": [
        "/(^|/)\\.py-version$/"
      ],
      "matchStrings": [
        "(?<currentValue>\\d+\\.\\d+\\.\\d+)\\n"
      ],
      "depNameTemplate": "python",
      "datasourceTemplate": "python-version",
      "versioningTemplate": "pep440"
    },
    {
      "description": "Track .uv-version for uv toolchain pinning",
      "customType": "regex",
      "managerFilePatterns": [
        "/(^|/)\\.uv-version$/"
      ],
      "matchStrings": [
        "(?<currentValue>\\d+\\.\\d+\\.\\d+)\\n"
      ],
      "depNameTemplate": "astral-sh/uv",
      "datasourceTemplate": "github-releases",
      "versioningTemplate": "semver"
    }
  ],
  "packageRules": [
    {
      "description": "Group official GitHub Actions",
      "groupName": "github-actions-official",
      "matchManagers": [
        "github-actions"
      ],
      "matchPackageNames": [
        "actions/**"
      ]
    },
    {
      "description": "Group Docker GitHub Actions",
      "groupName": "github-actions-docker",
      "matchManagers": [
        "github-actions"
      ],
      "matchPackageNames": [
        "docker/**"
      ]
    },
    {
      "description": "Group Astral GitHub Actions",
      "groupName": "github-actions-astral",
      "matchManagers": [
        "github-actions"
      ],
      "matchPackageNames": [
        "astral-sh/**"
      ]
    },
    {
      "description": "Group remaining GitHub Actions",
      "groupName": "github-actions-other",
      "matchManagers": [
        "github-actions"
      ],
      "matchPackageNames": [
        "!actions/**",
        "!docker/**",
        "!astral-sh/**"
      ]
    },
    {
      "description": "Auto-merge patch updates",
      "matchUpdateTypes": [
        "patch"
      ],
      "automerge": true,
      "automergeType": "pr"
    },
    {
      "description": "Group Python gRPC and protobuf packages",
      "groupName": "grpc-protobuf",
      "matchManagers": [
        "pep621"
      ],
      "matchPackageNames": [
        "grpcio",
        "grpcio-reflection",
        "protobuf"
      ]
    },
    {
      // Go modules, .go-version, and go-toolset are all in the "kubernetes"
      // group so that Go toolchain bumps and module updates land in one PR.
      // The go directive in go.mod (depType "golang") stays here too — no
      // separate go-toolchain group overrides it.
      //
      // Renovate cannot enforce that a module's required Go version is
      // available as a go-toolset image. If a module update raises the go
      // directive beyond what go-toolset provides, the PR's CI will fail,
      // which is the intended signal to wait for Red Hat to publish a
      // newer go-toolset tag.
      "description": "Group all Go module updates (any dep can bump the Go toolchain)",
      "groupName": "kubernetes",
      "matchManagers": [
        "gomod"
      ],
      "matchFileNames": [
        "controller/go.mod",
        "controller/deploy/operator/go.mod",
        "e2e/test/go.mod"
      ]
    },
    {
      "description": "Group Python Kubernetes clients",
      "groupName": "kubernetes-python",
      "matchManagers": [
        "pep621"
      ],
      "matchPackageNames": [
        "kubernetes",
        "kubernetes-asyncio"
      ]
    },
    {
      "description": "Custom versioning for devfile base-developer-image (track ubi major only)",
      "matchPackageNames": [
        "quay.io/devfile/base-developer-image"
      ],
      "versioning": "regex:^ubi(?<major>\\d+)-latest$",
      "pinDigests": false
    },
    {
      "description": "Custom versioning for MicroShift container images",
      "matchPackageNames": [
        "ghcr.io/microshift-io/microshift"
      ],
      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)_g[a-f0-9]+_\\d+\\.\\d+\\.\\d+_okd_scos\\.(?:(?<prerelease>ec\\.\\d+)|(?<build>\\d+))$"
    },
    {
      "description": "Restrict Fedora to stable releases, bump this cap when the next Fedora goes GA",
      "matchPackageNames": [
        "registry.fedoraproject.org/fedora",
        "registry.fedoraproject.org/fedora-minimal"
      ],
      "allowedVersions": "<=44",
      "pinDigests": false
    },
    {
      "description": "Group Docker base images",
      "groupName": "docker-base-images",
      "matchManagers": [
        "dockerfile",
        "docker-compose"
      ],
      "matchPackageNames": [
        "**"
      ],
      "automerge": false
    },
    {
      "description": "Group uv toolchain updates (version file + container image)",
      "groupName": "uv-toolchain",
      "matchDepNames": [
        "astral-sh/uv",
        "ghcr.io/astral-sh/uv"
      ]
    },
    {
      "description": "Group Python dev tools",
      "groupName": "python-dev-tools",
      "matchManagers": [
        "pep621"
      ],
      "matchPackageNames": [
        "ruff",
        "sphinx",
        "sphinx-**"
      ]
    },
    {
      "description": "Group go-toolset image with Go modules so version bumps are atomic",
      "groupName": "kubernetes",
      "matchManagers": [
        "dockerfile"
      ],
      "matchPackageNames": [
        "registry.access.redhat.com/ubi10/go-toolset"
      ],
      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
      "allowedVersions": "/^\\d+\\.\\d+\\.\\d+$/",
      "automerge": false
    },
    {
      "description": "Group .go-version with Go modules (tracks go-toolset, see customManagers)",
      "groupName": "kubernetes",
      "matchManagers": [
        "custom.regex"
      ],
      "matchDepNames": [
        "registry.access.redhat.com/ubi10/go-toolset"
      ],
      "allowedVersions": "/^\\d+\\.\\d+\\.\\d+$/",
      "automerge": false
    }
  ]
}