renovate-shared-config.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    // Base configuration
    "config:recommended",
    // Add "Signed-off-by" footer to commit messages
    ":gitSignOff",
    // Catch-all for grouping dependencies not caught by other groups
    "group:all",
    ":preserveSemverRanges"
  ],
  // Clone git submodules when analyzing repositories
  //
  // Some repositories use git submodules for vendored dependencies that are
  // referenced in Cargo.toml files. Without initializing submodules, Renovate
  // will fail to analyze these dependencies.
  "cloneSubmodules": true,
  // Custom datasource for tracking Rust nightly toolchain releases via the
  // official release manifest. This is the same data source the upcoming
  // native rust-version datasource (renovatebot/renovate#39529) will use;
  // once that merges this can be replaced with zero-config native support.
  "customDatasources": {
    "rust-nightly": {
      "defaultRegistryUrlTemplate": "https://static.rust-lang.org/manifests.txt",
      "format": "plain",
      "transformTemplates": [
        "{ \"releases\": $filter(releases, function($r) { $contains($r.version, \"channel-rust-nightly.toml\") }).$merge([{ \"version\": \"nightly-\" & $match(version, /(\\d{4}-\\d{2}-\\d{2})/).groups[0] }]) }"
      ]
    }
  },
  // Custom managers for detecting dependencies in non-standard files
  //
  // - Containerfile/Dockerfile: Match "# renovate:" comments with ARG statements
  // - .txt files: Match "# renovate:" comments followed by package@version on next line
  "customManagers": [
    {
      "customType": "regex",
      "managerFilePatterns": ["/(^|/)Containerfile(\\.[^/]*)?$/", "/(^|/)Dockerfile(\\.[^/]*)?$/"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z.-]+) depName=(?<depName>[^\\s]+)\\s+ARG \\w+version=(?<currentValue>.+)",
        "# renovate: datasource=(?<datasource>[a-z.-]+) depName=(?<depName>[^\\s]+) versioning=(?<versioning>[^\\s]+)\\s+ARG \\w+=(?<currentValue>.+)"
      ]
    },
    {
      "customType": "regex",
      "managerFilePatterns": ["**/*.txt"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\n.*@(?<currentValue>\\S+)"
      ]
    },
    // Shell scripts in GHA workflows/actions: Match "# renovate:" followed by
    // VERSION= or "export FOO_VERSION=" patterns
    {
      "customType": "regex",
      "managerFilePatterns": ["**/*.yml", "**/*.yaml"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\n\\s*(?:export )?\\w*VERSION=(?<currentValue>v?\\S+)"
      ]
    },
    // Container image digest pinning in JSON config files
    // Matches patterns like:
    //   "_renovate": "datasource=docker depName=quay.io/fedora/fedora-bootc",
    //   ...
    //   "source": "quay.io/fedora/fedora-bootc:43@sha256:abc123..."
    {
      "customType": "regex",
      "managerFilePatterns": ["**/sources.json"],
      "matchStrings": [
        "\"_renovate\":\\s*\"datasource=(?<datasource>docker) depName=(?<depName>[^\"]+)\"[^}]*\"source\":\\s*\"\\S+:(?<currentValue>[^@\\s\"]+)@(?<currentDigest>sha256:[a-f0-9]+)\""
      ]
    },
    // Git refs (commit SHA) tracking in Justfiles and YAML workflows
    // Justfile example:
    //   # renovate: datasource=git-refs depName=https://github.com/org/repo branch=main
    //   export VAR := env("VAR", "0000000000000000000000000000000000000000")
    // YAML example:
    //   # renovate: datasource=git-refs depName=https://github.com/org/repo branch=main
    //   VAR: '0000000000000000000000000000000000000000'
    {
      "customType": "regex",
      "managerFilePatterns": ["**/Justfile", "**/*.just", "**/*.yml", "**/*.yaml"],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>git-refs) depName=(?<depName>[^\\s]+) branch=(?<currentValue>[^\\s]+)\\n[^\\n]*\"(?<currentDigest>[a-f0-9]{40})\"",
        "# renovate: datasource=(?<datasource>git-refs) depName=(?<depName>[^\\s]+) branch=(?<currentValue>[^\\s]+)\\n[^\\n]*'(?<currentDigest>[a-f0-9]{40})'"
      ]
    }
  ],
  "packageRules": [
    // Limit dependency updates to once per week to reduce PR churn
    //
    // Rapidly-updating dependencies (e.g., opencode-ai) can create excessive PRs.
    // By scheduling updates to Sundays only, we get one PR per week with the
    // latest version, skipping all intermediate releases.
    //
    // Exception: bcvk updates immediately (excluded via negated regex).
    {
      "description": ["Limit dependency updates to weekly (Sundays UTC) to reduce PR churn. bcvk is excluded and updates immediately."],
      "matchPackageNames": ["!bootc-dev/bcvk"],
      "schedule": ["on sunday"],
      "timezone": "UTC"
    },
    {
    // These files in these repos are synced from the bootc-dev/infra repository, which
    // sends PRs to update them. Ignoring them here to avoid conflicting Renovate updates.
      "matchRepositories": [
        "bootc-dev/bootc",
        "bootc-dev/bcvk",
        "bootc-dev/ci-sandbox",
        "bootc-dev/containers-image-proxy-rs",
        "bootc-dev/bootc-dev.github.io",
        "composefs/composefs",
        "composefs/composefs-rs"
      ],
      "ignorePaths": [
        ".github/workflows/rebase.yml",
        ".github/workflows/openssf-scorecard.yml",
        ".github/actions/bootc-ubuntu-setup/action.yml",
        ".github/actions/setup-rust/action.yml"
      ]
    },
    // Group GitHub Actions dependencies
    {
      "description": ["GitHub Actions dependencies"],
      "matchManagers": [
        "github-actions"
      ],
      "groupName": "GitHub Actions",
      "enabled": true
    },
    // Group Rust dependencies
    //
    // separateMultipleMajor splits each semver-breaking bump into its own PR
    // so they can be reviewed/landed independently. Cargo versioning treats
    // 0.x -> 0.y as major, so this covers both pre-1.0 and post-1.0 crates.
    {
      "description": ["Rust dependencies"],
      "matchManagers": [
        "cargo"
      ],
      "groupName": "Rust",
      "separateMultipleMajor": true,
      "enabled": true
    },
    // Treat git-ref Cargo dependencies the same as major version bumps: give
    // each one its own PR instead of bundling into the weekly grouped
    // "Rust" PR above.
    //
    // Deps pinned via `git = "...", rev = "<sha>"` (e.g. bootc-mount in
    // bcvk) have no semver, so Renovate can't classify an upstream change
    // as major/minor/patch - it always reports these as "digest" updates,
    // which would otherwise get silently folded into the routine "Rust"
    // update, even though a git-ref bump can carry arbitrary breaking
    // changes just like a major version bump. `groupName: null` clears the
    // groupName set by the "Rust" rule above, so each dependency gets its
    // own individual PR (Renovate's default when a dep isn't grouped) -
    // note this is stricter isolation than plain major bumps get today,
    // since those still combine multiple crates needing a major bump into
    // one shared PR; `separateMultipleMajor` above only splits a *single*
    // crate's multiple major-version jumps into separate PRs. Must come
    // after the "Rust" group rule above so this override takes precedence
    // (Renovate applies matching rules in order, later rules win).
    //
    // Note: deps pinned via `branch = "..."` instead of `rev` (e.g.
    // composefs-run) are skipped by Renovate's cargo manager entirely -
    // they get no update PRs at all today, regardless of this rule.
    {
      "description": ["Treat git-ref Cargo dependency updates the same as major version bumps (own PR per dependency, not bundled into the weekly Rust group)"],
      "matchManagers": ["cargo"],
      "matchDatasources": ["git-refs"],
      "matchUpdateTypes": ["digest"],
      "groupName": null
    },
    // Restore cargo's default rangeStrategy for in-range updates.
    //
    // ":preserveSemverRanges" sets rangeStrategy=replace globally, which means
    // Renovate only acts when a new version falls *outside* the existing range.
    // For cargo deps like `tar = "0.4.43"` (i.e. ^0.4.43), patch releases such
    // as 0.4.46 are in-range and would be silently ignored - Cargo.lock never
    // gets updated. Restoring `update-lockfile` here makes Renovate bump
    // Cargo.lock for in-range updates while still using `replace` for
    // out-of-range ones (the same as cargo's native default behaviour).
    {
      "description": ["Restore update-lockfile rangeStrategy for cargo (overrides :preserveSemverRanges)"],
      "matchManagers": ["cargo"],
      "rangeStrategy": "update-lockfile"
    },
    // Group Docker dependencies
    {
      "description": ["Docker dependencies"],
      "matchManagers": [
        "dockerfile",
        "custom.regex"
      ],
      "groupName": "Docker",
      "enabled": true
    },
    // Group staged bootc base image digest updates separately
    //
    // These are the upstream source images for chunkah-staged builds.
    // Digest updates trigger a rebuild of the staged images, so they
    // get their own PR. Must come after the Docker group rule so it
    // takes precedence (Renovate applies all matching rules in order,
    // later rules win).
    {
      "description": ["Staged bootc base image digest updates"],
      "matchManagers": ["custom.regex"],
      "matchDepNames": [
        "quay.io/fedora/fedora-bootc",
        "quay.io/centos-bootc/centos-bootc"
      ],
      "groupName": "staged-images"
    },
    // bcvk gets its own group so it isn't blocked by the weekly schedule
    // applied to other Docker group members. Without this, the Docker group
    // PR can only be created on Sundays (when all deps are in-schedule),
    // even though bcvk itself is excluded from the weekly schedule above.
    {
      "description": ["bcvk updates independently of the Docker group"],
      "matchPackageNames": ["bootc-dev/bcvk"],
      "groupName": "bcvk"
    },
    // Group npm dependencies
    {
      "description": ["npm dependencies"],
      "matchDatasources": ["npm"],
      "groupName": "npm",
      "enabled": true
    },
    // Disable Containerfile digest pinning
    {
      "description": ["Containerfile digest pinning"],
      "matchManagers": [
        "dockerfile"
      ],
      "pinDigests": false
    },
    // Disable Fedora OCI tag updates
    //
    // Renovate can't distinguish stable vs unreleased Fedora versions,
    // so we disable tag bumps. Digest-only updates are still allowed
    // via the separate rule below.
    {
      "description": ["Disable Fedora OCI tag updates (can't distinguish stable vs unreleased)"],
      "matchManagers": [
        "dockerfile",
        "github-actions",
        "custom.regex"
      ],
      "matchDepNames": [
        "quay.io/fedora/fedora",
        "quay.io/fedora/fedora-bootc"
      ],
      "matchUpdateTypes": ["major", "minor", "patch"],
      "enabled": false
    },
    // Ignore bootc cargo dependencies to fix failing Renovate task
    // See: https://github.com/bootc-dev/infra/actions/runs/19914695687
    {
      "matchManagers": ["cargo"],
      "matchPackageNames": [
        "composefs",
        "composefs-ctl",
        "composefs-boot",
        "composefs-oci"
      ],
      "enabled": false
    },
    // nextest-rs/nextest is a monorepo with multiple crates released under
    // different tag prefixes (cargo-nextest-*, nextest-runner-*, etc.).
    // Extract only the cargo-nextest version from matching tags.
    {
      "matchPackageNames": ["nextest-rs/nextest"],
      "extractVersion": "^cargo-nextest-(?<version>.*)$"
    },
    // Rust nightly toolchain: use rust-release-channel versioning for nightly-YYYY-MM-DD format
    {
      "matchDatasources": ["custom.rust-nightly"],
      "versioning": "rust-release-channel"
    }
  ]
}