home-network-k3s-impl/decisions/2026-11-08-renovate-config-cleanup.md

date, branch, title

date	branch	title
2026-11-08	chore/renovate-config-cleanup	Renovate config — hand-migrate the docker key, track gitea/runner, keep HelmRelease range lower bounds

What changed

• renovate.json5: the deprecated top-level "docker": {"enabled": true} is hand-migrated to packageRules[0] = {"matchCategories": ["docker"], "enabled": true}, the exact shape Renovate's own migration produced on origin/renovate/migrate-config (PR #139). Its comment moved with it. This replaces #139, which was closed because its rewrite deleted every comment in the file. No other comment was removed or reflowed (diff is additions plus the moved block).
• gitea/runner added to the blast-radius rule beside gitea/act_runner, with a comment: act_runner was renamed upstream to gitea/runner after 0.6.1; Renovate does not follow renames, so the actual image migration is a separate manual PR.
• Two new packageRules for flux/helm >=A <B ranges: rangeStrategy: "bump", plus matchUpdateTypes: ["bump"] -> enabled: false, so in-range releases (which Flux adopts on its own) do not become PRs. Cause of the bug, from the 44.167.0 source: rangeStrategy is unset (auto); the flux manager has no getRangeStrategy/updateLockedDependency, so lib/modules/manager/index.ts getRangeStrategy resolves auto to replace; helm versioning is the npm api verbatim, and npm getNewValue under replace turns >=1.12.0 <1.13.0 into <1.14.0 (what PRs #131, #130 and #115 did).
• platform/headlamp/helmrelease.yaml: version: "<0.47.0" -> ">=0.46.0 <0.47.0", comment refreshed. The live chart is 0.46.0, so the set of installable charts is unchanged.

What I verified

• Semantic diff of #139: I parsed renovate.json5 on origin/renovate/migrate-config and on its parent 5b484f6 with json5 (the copy inside the renovate image). With docker removed from the parent and packageRules[0] removed from the migrated file, the two are identical. So the only change was {"matchCategories":["docker"],"enabled":true}, inserted at packageRules[0].
• Validator, ghcr.io/renovatebot/renovate:44.167.0 (the tag that .gitea/workflows/renovate.yaml pins as container.image): renovate-config-validator gives Config validated successfully (rc 0), and so does --strict (rc 0), both as a file path and in repo mode. --strict on origin/main's file gives rc 1 and prints the docker migration diff. Nothing is left to migrate.
• getNewValue called in the 44.167.0 image (helm versioning), currentValue >=1.12.0 <1.13.0, newVersion 1.13.0: replace <1.14.0, widen >=1.12.0 <1.14.0, bump >=1.13.0 <1.14.0, pin/update-lockfile <1.14.0. On <0.47.0, bump returns the value unchanged, so it would never propose anything for that range. That is why the rule is scoped to the >=A <B shape.
• Local dry run (--platform=local, RENOVATE_DRY_RUN=lookup, 44.167.0, live chart repos) against a fixture repo of four HelmReleases under platform/:
  • With this branch's config: No config migration necessary. longhorn >=1.9.0 <1.10.0 -> >=1.13.0 <1.14.0 (minor). kube-prometheus-stack >=88.0.0 <89.0.0 -> >=93.1.0 <94.0.0 (major). The in-range bump >=88.6.5 <89.0.0 was dropped (Filtered out 1 disabled update(s)). headlamp >=0.46.0 <0.47.0 and <0.47.0: no update.
  • Control run with origin/main's config: Config migration necessary, longhorn -> <1.14.0, kube-prometheus-stack -> <94.0.0. This reproduces the reported bug.
• Live headlamp HelmRelease (read-only kubectl, k3s-prod): spec <0.47.0, history chartVersion 0.46.0, Ready True.

What I did NOT verify

• I have not seen a real scheduled Renovate run against this repo with this config. The claim that Renovate stops reopening the migrate-config PR rests on the validator and on No config migration necessary in the local dry run, not on the Gitea bot. After merge, watch the next run, and if renovate/migrate-config is still on the remote, delete it.
• Under bump, the new lower bound is the release Renovate proposes, e.g. >=1.13.2 <1.14.0, not >=1.13.0. Flux still installs the newest release in the window. Ranges with other shapes keep the default replace: 3.9.x, ~, ceiling-only, and exact pins.
• The open PRs #131, #115 and any others still carry unbounded <X values. They were generated under the old strategy, and Renovate should rebase or regenerate them under bump on its next run. I have not checked that it does.
• The gitea/runner rename itself (a new image reference and any config changes) is not done here.