Supersedes #139 (closed: Renovate's own migration rewrote renovate.json5 and dropped all 177 comment lines).
Changes
Hand-migrate the deprecated top-level docker key to packageRules[0] = {"matchCategories": ["docker"], "enabled": true}. That is the exact shape Renovate's migration produced on renovate/migrate-config. I compared it with a json5 semantic diff against its parent 5b484f6: removing that rule and the old key makes the two identical. Every existing comment is kept, and the old key's comment moved with it.
gitea/runner added to the blast-radius rule, next to gitea/act_runner (upstream renamed it after 0.6.1; Renovate does not follow renames, so the image migration will be a manual PR).
Keep the lower bound on HelmRelease ranges. The cause: rangeStrategy is unset, so it is auto. Flux has no getRangeStrategy, so auto resolves to replace. Helm versioning is the npm versioning, and npm getNewValue under replace rewrote >=1.12.0 <1.13.0 to <1.14.0 (#131, #130, #115). Calling getNewValue inside renovate:44.167.0 for 1.13.0:
replace -> <1.14.0
widen -> >=1.12.0 <1.14.0
bump -> >=1.13.0 <1.14.0
New rules, scoped to flux + helm + >=A <B ranges:
rangeStrategy: bump
matchUpdateTypes: ["bump"] -> enabled: false, so releases already inside the range (which Flux installs anyway) do not become PRs.
headlamp <0.47.0 -> >=0.46.0 <0.47.0 (the live chart is 0.46.0, measured read-only).
Evidence
renovate-config-validator at 44.167.0 (the container.image pin): Config validated successfully, rc 0, also with --strict. --strict on main's file: rc 1 (pending migration).
Local dry run (--platform=local, dryRun=lookup, 44.167.0) on a fixture repo:
This branch's config: No config migration necessary. longhorn >=1.9.0 <1.10.0 -> >=1.13.0 <1.14.0. kps >=88.0.0 <89.0.0 -> >=93.1.0 <94.0.0. The in-range bump was filtered out as disabled.
Local toolbox gate: rc 3. The only stage not run is gitea-settings (no token locally). spec-immutability, approval-policy, decisions-log (78 entries), lint, l0, render-golden and l1 passed.
Supersedes #139 (closed: Renovate's own migration rewrote `renovate.json5` and dropped all 177 comment lines).
## Changes
1. **Hand-migrate the deprecated top-level `docker` key** to `packageRules[0] = {"matchCategories": ["docker"], "enabled": true}`. That is the exact shape Renovate's migration produced on `renovate/migrate-config`. I compared it with a json5 semantic diff against its parent `5b484f6`: removing that rule and the old key makes the two identical. Every existing comment is kept, and the old key's comment moved with it.
2. **`gitea/runner` added to the blast-radius rule**, next to `gitea/act_runner` (upstream renamed it after 0.6.1; Renovate does not follow renames, so the image migration will be a manual PR).
3. **Keep the lower bound on HelmRelease ranges.** The cause: `rangeStrategy` is unset, so it is `auto`. Flux has no `getRangeStrategy`, so `auto` resolves to `replace`. Helm versioning is the npm versioning, and npm `getNewValue` under `replace` rewrote `>=1.12.0 <1.13.0` to `<1.14.0` (#131, #130, #115). Calling `getNewValue` inside `renovate:44.167.0` for 1.13.0:
- `replace` -> `<1.14.0`
- `widen` -> `>=1.12.0 <1.14.0`
- **`bump` -> `>=1.13.0 <1.14.0`**
New rules, scoped to flux + helm + `>=A <B` ranges:
- `rangeStrategy: bump`
- `matchUpdateTypes: ["bump"] -> enabled: false`, so releases already inside the range (which Flux installs anyway) do not become PRs.
4. **headlamp `<0.47.0` -> `>=0.46.0 <0.47.0`** (the live chart is 0.46.0, measured read-only).
## Evidence
- `renovate-config-validator` at 44.167.0 (the `container.image` pin): `Config validated successfully`, rc 0, also with `--strict`. `--strict` on main's file: rc 1 (pending migration).
- Local dry run (`--platform=local`, `dryRun=lookup`, 44.167.0) on a fixture repo:
- This branch's config: `No config migration necessary`. longhorn `>=1.9.0 <1.10.0` -> `>=1.13.0 <1.14.0`. kps `>=88.0.0 <89.0.0` -> `>=93.1.0 <94.0.0`. The in-range bump was filtered out as disabled.
- Main's config: `Config migration necessary`, longhorn -> `<1.14.0`, kps -> `<94.0.0`.
- Local toolbox gate: rc 3. The only stage not run is `gitea-settings` (no token locally). spec-immutability, approval-policy, decisions-log (78 entries), lint, l0, render-golden and l1 passed.
Handoff entry: `decisions/2026-11-08-renovate-config-cleanup.md`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Replace the deprecated top-level `docker` key with the packageRule Renovate's
own migration produced (matchCategories docker, enabled true), keeping every
comment. Supersedes #139, which dropped all comment lines.
- Add gitea/runner (act_runner's upstream rename) to the blast-radius rule.
- rangeStrategy bump for flux/helm `>=A <B` ranges: the default `auto` resolves
to `replace`, which turned `>=1.12.0 <1.13.0` into `<1.14.0` (#131, #130,
#115). In-range `bump` updates are disabled; Flux adopts those unaided.
- Restore headlamp's lower bound: `<0.47.0` -> `>=0.46.0 <0.47.0` (live 0.46.0).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Supersedes #139 (closed: Renovate's own migration rewrote
renovate.json5and dropped all 177 comment lines).Changes
Hand-migrate the deprecated top-level
dockerkey topackageRules[0] = {"matchCategories": ["docker"], "enabled": true}. That is the exact shape Renovate's migration produced onrenovate/migrate-config. I compared it with a json5 semantic diff against its parent5b484f6: removing that rule and the old key makes the two identical. Every existing comment is kept, and the old key's comment moved with it.gitea/runneradded to the blast-radius rule, next togitea/act_runner(upstream renamed it after 0.6.1; Renovate does not follow renames, so the image migration will be a manual PR).Keep the lower bound on HelmRelease ranges. The cause:
rangeStrategyis unset, so it isauto. Flux has nogetRangeStrategy, soautoresolves toreplace. Helm versioning is the npm versioning, and npmgetNewValueunderreplacerewrote>=1.12.0 <1.13.0to<1.14.0(#131, #130, #115). CallinggetNewValueinsiderenovate:44.167.0for 1.13.0:replace-><1.14.0widen->>=1.12.0 <1.14.0bump->>=1.13.0 <1.14.0New rules, scoped to flux + helm +
>=A <Branges:rangeStrategy: bumpmatchUpdateTypes: ["bump"] -> enabled: false, so releases already inside the range (which Flux installs anyway) do not become PRs.headlamp
<0.47.0->>=0.46.0 <0.47.0(the live chart is 0.46.0, measured read-only).Evidence
renovate-config-validatorat 44.167.0 (thecontainer.imagepin):Config validated successfully, rc 0, also with--strict.--stricton main's file: rc 1 (pending migration).--platform=local,dryRun=lookup, 44.167.0) on a fixture repo:No config migration necessary. longhorn>=1.9.0 <1.10.0->>=1.13.0 <1.14.0. kps>=88.0.0 <89.0.0->>=93.1.0 <94.0.0. The in-range bump was filtered out as disabled.Config migration necessary, longhorn -><1.14.0, kps -><94.0.0.gitea-settings(no token locally). spec-immutability, approval-policy, decisions-log (78 entries), lint, l0, render-golden and l1 passed.Handoff entry:
decisions/2026-11-08-renovate-config-cleanup.md.🤖 Generated with Claude Code