jakman85andClaude Opus 4.8
f538f8ff38
Map a ServiceDefinition `update` block to ImageRepository/ImagePolicy + the $imagepolicy setter marker: stable-only (semver range + bare-X.Y.Z filterTags, pre-release excluded, R-UPD-01), pin -> fixed image with no marker / suspended policy (R-UPD-03). Worked pihole example under per-service/ (reference only, not deployed; WS-GITOPS emits the equivalent into apps/<svc>/). Add renovate.json for Helm chart / dependency / operator-manifest bumps: auto-merge minor/patch/digest on green CI, major needs review, image managers disabled so Renovate never fights Flux over a tag. Co-Authored-By: Claude Opus 4.8 <[email protected]>
74 lines
3.3 KiB
JSON
74 lines
3.3 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"_comment": "Renovate config — Phase 4 automated updates (ADR-0009, R-UPD-01/02). Renovate owns HELM CHART + DEPENDENCY bumps (opens PRs; allowed classes auto-merge on green CI). Flux image-automation owns per-service container IMAGE TAGS (the $imagepolicy setters). The two do NOT overlap: this config DISABLES image-tag updates so Renovate never fights Flux over a running version. Self-hosted against the bootstrap Gitea; platform: gitea set at runtime by the operator's renovate runner.",
|
|
"extends": [
|
|
"config:recommended",
|
|
":dependencyDashboard",
|
|
":semanticCommits",
|
|
"helpers:pinGitHubActionDigests"
|
|
],
|
|
"timezone": "America/New_York",
|
|
"schedule": ["after 3am and before 6am"],
|
|
"prConcurrentLimit": 5,
|
|
"prHourlyLimit": 2,
|
|
"commitMessagePrefix": "chore(deps):",
|
|
"labels": ["dependencies", "automated-update"],
|
|
"ignoreUnstable": true,
|
|
"respectLatest": true,
|
|
"enabledManagers": ["flux", "kustomize", "helmv3", "regex", "github-actions"],
|
|
"flux": {
|
|
"managerFilePatterns": ["/(^|/)platform/.+\\.ya?ml$/", "/(^|/)apps/.+\\.ya?ml$/"]
|
|
},
|
|
"kustomize": {
|
|
"managerFilePatterns": ["/(^|/)kustomization\\.ya?ml$/"]
|
|
},
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Inline `# renovate: datasource=... depName=...` markers on pinned URLs / version literals (e.g. platform/kubevirt/kustomization.yaml release URLs, ci/versions.env, infra/devcontainer/versions.env).",
|
|
"managerFilePatterns": [
|
|
"/(^|/)kustomization\\.ya?ml$/",
|
|
"/(^|/)versions\\.env$/"
|
|
],
|
|
"matchStrings": [
|
|
"#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?\\s*\\n.*?(?<currentValue>v?[0-9]+\\.[0-9]+\\.[0-9]+)"
|
|
],
|
|
"versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
|
|
}
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"description": "Auto-merge the allowed low-risk classes on green CI — no human authoring (R-UPD-02). The Gitea merge gate (make -C ci gate) is the required check.",
|
|
"matchUpdateTypes": ["minor", "patch", "digest"],
|
|
"automerge": true,
|
|
"automergeType": "pr",
|
|
"platformAutomerge": true
|
|
},
|
|
{
|
|
"description": "MAJOR / potentially-breaking bumps require human review (docs/11 safety rail). Never auto-merged.",
|
|
"matchUpdateTypes": ["major"],
|
|
"automerge": false,
|
|
"addLabels": ["needs-review", "breaking"]
|
|
},
|
|
{
|
|
"description": "Keep the KubeVirt + CDI operator pair on a compatible track — grouped so they bump together (platform/kubevirt/kustomization.yaml).",
|
|
"matchDepNames": ["kubevirt/kubevirt", "kubevirt/containerized-data-importer"],
|
|
"groupName": "kubevirt-cdi"
|
|
},
|
|
{
|
|
"description": "Pinned tool versions (ci/versions.env, infra/devcontainer/versions.env) are a deliberate change surface — label but do not auto-merge; a version bump there changes CI reproducibility.",
|
|
"matchFileNames": ["ci/versions.env", "infra/devcontainer/versions.env"],
|
|
"automerge": false,
|
|
"addLabels": ["ci-tooling"]
|
|
}
|
|
],
|
|
"ignorePaths": [
|
|
"**/*.example",
|
|
"**/*.sops.yaml",
|
|
"conformance/**",
|
|
"platform/image-automation/per-service/**"
|
|
],
|
|
"docker": { "enabled": false },
|
|
"kubernetes": { "enabled": false }
|
|
}
|