mirror of
https://github.com/go-gitea/gitea.git
synced 2026-04-26 21:29:22 +00:00
99cd4f6b22
Replaces Dependabot with Renovate. The new setup: - One PR per ecosystem (GitHub Actions, Go modules + Makefile go-tool pins, npm, Python via uv, Nix flake), opened weekly on Mondays with a 5-day release-age cooldown. Vulnerability PRs ship next-day via daily cron + Renovate's `vulnerabilityAlerts` schedule bypass. - All `uses:` action refs SHA-pinned with patch-level version comments (same format as #36971, which this supersedes); `helpers:pinGitHubActionDigests` keeps future bumps in that format. - `renovatebot/github-action` runtime image pinned via the upstream-recommended `RENOVATE_VERSION` env + magic comment + `customManagers:githubActionsVersions` preset, so Renovate keeps the pin updated. - Custom regex manager tracks the `*_PACKAGE ?= <import-path>@<version>` lines in `Makefile` (golangci-lint, swagger, actionlint, etc.) and groups them into the same Go PR via `matchDatasources: ["go"]`. - Post-upgrade tasks regenerate `assets/go-licenses.json` (`make tidy`) and the SVG sprite (`make svg`), gated by an env-level command allowlist. - Replaces the standalone `cron-flake-updater` workflow — Renovate's nix manager tracks `flake.nix` inputs and produces the same `flake.lock` bump PRs on the regular weekly schedule. - npm and gomod-replace pins live in `renovate.json5` only; `updates@17.16.3` reads them from there too, so the standalone `updates.config.ts` is gone and one source of truth covers both tools. Fixes: https://github.com/go-gitea/gitea/issues/33386 Signed-off-by: silverwind <me@silverwind.io> Signed-off-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io>
89 lines
2.9 KiB
Plaintext
89 lines
2.9 KiB
Plaintext
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": ["config:recommended", "helpers:pinGitHubActionDigests", "customManagers:githubActionsVersions"],
|
|
"configMigration": true,
|
|
"enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix"],
|
|
"labels": ["dependencies"],
|
|
"branchPrefix": "renovate/",
|
|
"schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
|
|
"minimumReleaseAge": "5 days",
|
|
"semanticCommits": "enabled",
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
},
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"managerFilePatterns": ["/(^|/)Makefile$/"],
|
|
"matchStrings": [
|
|
"[A-Z_]+_PACKAGE\\s*\\?=\\s*(?<depName>[^@\\s]+?)(?:/cmd/[^@/\\s]+)?@(?<currentValue>\\S+)\\s+# renovate: datasource=(?<datasource>\\S+)",
|
|
],
|
|
},
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"groupName": "action dependencies",
|
|
"matchManagers": ["github-actions"],
|
|
},
|
|
{
|
|
"matchPackageNames": ["@mcaptcha/vanilla-glue"],
|
|
"allowedVersions": "^0.1", // breaking changes in rc versions need to be handled
|
|
},
|
|
{
|
|
"matchPackageNames": ["cropperjs"],
|
|
"allowedVersions": "^1", // need to migrate to v2 but v2 is not compatible with v1
|
|
},
|
|
{
|
|
"matchPackageNames": ["tailwindcss"],
|
|
"allowedVersions": "^3", // need to migrate
|
|
},
|
|
{
|
|
"matchPackageNames": ["github.com/urfave/cli/v3"],
|
|
"allowedVersions": "<3.6.2", // v3.6.2 breaks -c flag parsing in help commands
|
|
},
|
|
{
|
|
"matchPackageNames": ["github.com/Azure/azure-sdk-for-go/sdk/azcore"],
|
|
"allowedVersions": "<1.21.0", // v1.21.0+ uses API version unsupported by Azurite in CI
|
|
},
|
|
{
|
|
"matchPackageNames": ["github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"],
|
|
"allowedVersions": "<1.6.4", // v1.6.4+ uses API version unsupported by Azurite in CI
|
|
},
|
|
{
|
|
"matchPackageNames": ["github.com/microsoft/go-mssqldb"],
|
|
"allowedVersions": "<=1.9.7", // downgraded with Azure SDK
|
|
},
|
|
{
|
|
"matchPackageNames": ["go.yaml.in/yaml/v4"],
|
|
"allowedVersions": "<4.0.0-rc.4", // rc.4 changes block scalar serialization, wait for stable release
|
|
},
|
|
{
|
|
"groupName": "go dependencies",
|
|
"matchDatasources": ["go"], // covers gomod manager + Makefile go-tool customManager
|
|
"postUpgradeTasks": {
|
|
"commands": ["make tidy"],
|
|
"fileFilters": ["go.mod", "go.sum", "assets/go-licenses.json"],
|
|
"executionMode": "branch",
|
|
},
|
|
},
|
|
{
|
|
"groupName": "npm dependencies",
|
|
"matchManagers": ["npm"],
|
|
"postUpgradeTasks": {
|
|
"commands": ["make svg"],
|
|
"fileFilters": ["public/assets/img/svg/**"],
|
|
"executionMode": "branch",
|
|
},
|
|
},
|
|
{
|
|
"groupName": "python dependencies",
|
|
"matchManagers": ["pep621"],
|
|
},
|
|
{
|
|
"groupName": "nix dependencies",
|
|
"matchManagers": ["nix"],
|
|
},
|
|
],
|
|
}
|